high7.2Public exploit code
CVE-2021-24786
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when vi…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Wordpress Plugin Download Monitor WordPress V 4.4.4 - SQL Injection (Authenticated)2022-02-02 · webapps · php
Impact
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Wpchill | Download Monitor | before 4.4.5 |