CVE-2024-7857: Media Library Folders <= 8.2.2 - Authenticated (Subscriber+) Second-Order SQL Injection
The Media Library Folders plugin for WordPress is vulnerable to second order SQL Injection via the 'sorttype' parameter of the 'mlfchangesorttype' AJAX action in all versions up to, and including, 8.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7857?
CVE-2024-7857 is considered a high severity vulnerability due to the potential for second order SQL injection exploitation.
How do I fix CVE-2024-7857?
To fix CVE-2024-7857, upgrade the Media Library Folders plugin to version 8.2.3 or later.
What types of attacks can exploit CVE-2024-7857?
CVE-2024-7857 can be exploited through second order SQL injection attacks that manipulate the 'sort_type' parameter.
Which versions of Media Library Folders are affected by CVE-2024-7857?
All versions of Media Library Folders up to and including version 8.2.2 are affected by CVE-2024-7857.
Is user input sanitization a factor in CVE-2024-7857's vulnerability?
Yes, insufficient escaping on user supplied parameters contributes to the vulnerability identified in CVE-2024-7857.