PT-2021-16201 · WordPress · Simple Download Monitor

Apple502J · Published 2021-11-08 · Updated 2021-11-11 · CVE-2021-24697

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Simple Download Monitor WordPress plugin versions prior to 3.9.5

Description The issue arises from the failure to escape certain parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues. The parameters in question are the sdm active tab GET parameter and the sdm stats start date and sdm stats end date POST parameters.

Recommendations For versions prior to 3.9.5, update to version 3.9.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the parameters sdm active tab, sdm stats start date, and sdm stats end date to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24697

Affected Products

Simple Download Monitor

References · 5

• 🔥 https://wpscan.com/vulnerability/ef9ae513-6c29-45c2-b5ae-4a06a217c499 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24697 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24697 · Vendor Advisory
• https://t.me/cvenotify/23149 · Telegram Post
• https://t.me/cibsecurity/32005 · Telegram Post