PT-2025-2227 · WordPress · Simple Downloads List
Peter Thaleikis
·
Published
2025-01-24
·
Updated
2025-02-05
·
CVE-2024-13594
CVSS v3.1
6.5
Medium
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Simple Downloads List plugin for WordPress versions up to, and including, 1.4.2
Description
The issue concerns a SQL injection vulnerability via the
category attribute of the neofix sdl shortcode. This vulnerability is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. Authenticated attackers with Contributor-level access and above can append additional SQL queries to existing ones, potentially extracting sensitive information from the database.Recommendations
For versions up to, and including, 1.4.2, update to a version higher than 1.4.2 to resolve the issue.
As a temporary workaround, consider restricting access to the
neofix sdl shortcode to minimize the risk of exploitation.
Avoid using the category attribute in the neofix sdl shortcode until the issue is resolved.Fix
SQL injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Simple Downloads List