Download Manager, 2a9331b1-1d43-4729-bb0a-9198ffe3d703

CVE, Research URL: 2a9331b1-1d43-4729-bb0a-9198ffe3d703
Home page URL: Security reports for Download Manager
Application: Download Manager
Published on: -
Research Description: Download Manager [download-manager] < 3.1.22 Download Manager < 3.1.22 - Plugin Settings Change via CSRF The wpdm_settings AJAX action, used the section POST parameter to call the associated settings handler methods dynamically. However, the pluginUpdate() (section=plugin-update) and Privacy() (section=privacy) were missing CSRF checks. Furthermore, the Privacy() function did not ensure that the options to be updated were actually related to privacy, allowing any option key containing _wpdm_ to be updated.
Affected versions: max 3.1.22.
Status: vulnerable