Description

WordPress Plugin WP-Filebase Download Manager is prone to an SQL injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. WordPress Plugin WP-Filebase Download Manager version 0.2.9 is vulnerable; other versions may also be affected.

Remediation

Update to plugin version 0.2.9.1 or latest

References

http://www.securityfocus.com/bid/49501/exploit

http://www.exploit-db.com/exploits/17808/

http://secunia.com/advisories/45931/

http://packetstormsecurity.com/files/view/104949/wpfilebase-sql.txt

https://wordpress.org/support/topic/wordpress-wp-filebase-download-manager-plugin

Related Vulnerabilities

MySQL CVE-2018-3060 Vulnerability (CVE-2018-3060)

WordPress Plugin RESPONSIVE 3D SLIDER SQL Injection (1.2)

MySQL CVE-2020-14789 Vulnerability (CVE-2020-14789)

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14349)

PostgreSQL Generation of Error Message Containing Sensitive Information Vulnerability (CVE-2014-8161)

Severity

High

Classification

CWE-89 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update SQL Injection