#VU19210 SQL injection in File Manager
Published: July 17, 2019
File Manager
mndpsingh287
Description
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to not checking the authentication of the user properly in the wp_ajax_* action calls. A remote attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to backup download, backup deletion and backup restoration in the backup feature of the plugin.
The following registered wp_ajax_* hooks are vulnerable: mk_file_manager_backup_remove_callback, mk_file_manager_single_backup_remove_callback, mk_file_manager_single_backup_logs_callback and mk_file_manager_single_backup_restore_callback.