CVE-2024-7857: Media Library Folders <= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection
First published: Thu Aug 29 2024(Updated: )
The Media Library Folders plugin for WordPress is vulnerable to second order SQL Injection via the 'sort_type' parameter of the 'mlf_change_sort_type' AJAX action in all versions up to, and including, 8.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Media Library Folders | <=8.2.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d2266254-9281-4859-8630-f7bb5c0ead19?source=cve
- https://plugins.trac.wordpress.org/changeset/3139954/media-library-plus/trunk/media-library-plus.php
- https://plugins.trac.wordpress.org/browser/media-library-plus/tags/8.2.2/media-library-plus.php#L1766
- https://plugins.trac.wordpress.org/browser/media-library-plus/tags/8.2.2/media-library-plus.php#L3339
Frequently Asked Questions
What is the severity of CVE-2024-7857?
CVE-2024-7857 is considered a high severity vulnerability due to the potential for second order SQL injection exploitation.
How do I fix CVE-2024-7857?
To fix CVE-2024-7857, upgrade the Media Library Folders plugin to version 8.2.3 or later.
What types of attacks can exploit CVE-2024-7857?
CVE-2024-7857 can be exploited through second order SQL injection attacks that manipulate the 'sort_type' parameter.
Which versions of Media Library Folders are affected by CVE-2024-7857?
All versions of Media Library Folders up to and including version 8.2.2 are affected by CVE-2024-7857.
Is user input sanitization a factor in CVE-2024-7857's vulnerability?
Yes, insufficient escaping on user supplied parameters contributes to the vulnerability identified in CVE-2024-7857.
- agent/weakness
- agent/references
- agent/title
- agent/description
- agent/type
- agent/first-publish-date
- agent/severity
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/media library folders
- canonical/media library folders