vendor:
Double Opt-In for Download
by:
Kacper Szurek
7,5
CVSS
HIGH
SQL Injection
89
CWE
Product Name: Double Opt-In for Download
Affected Version From: 2.0.9
Affected Version To: 2.0.9
Patch Exists: YES
Related CWE: N/A
CPE: a:wordpress:double_opt-in_for_download
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2016
Double Opt-In for Download 2.0.9 Sql Injection
$_POST['id'] is not escaped and `populate_download_edit_form()` is accessible for every registered user.
Mitigation:
Update to version 2.1.0
