CVE-2018-5213: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdm_upload (aka Downloadable File) parameter in an edit action to wp-admin/post.php.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2018-01-04T18:29Z
Repository: https://github.com/Arsenal21/simple-download-monitor
Language: PHP
Files changed: simple-download-monitor/main.php, simple-download-monitor/readme.txt
Commit date: 2018-01-04 11:12:19 +1100
Commit message: v3.5.4 released
Diff: diff --git a/simple-download-monitor/main.php b/simple-download-monitor/main.php
index c6bbd68..11c513e 100644
--- a/simple-download-monitor/main.php
+++ b/simple-download-monitor/main.php
@@ -1,11 +1,11 @@
 <?php
 /**
  * Plugin Name: Simple Download Monitor
  * Plugin URI: https://www.tipsandtricks-hq.com/simple-wordpress-download-monitor-plugin
  * Description: Easily manage downloadable files and monitor downloads of your digital files from your WordPress site.
- * Version: 3.5.3
+ * Version: 3.5.4
  * Author: Tips and Tricks HQ, Ruhul Amin, Josh Lobe
  * Author URI: https://www.tipsandtricks-hq.com/development-center
  * License: GPL2
  * Text Domain: simple-download-monitor
  * Domain Path: /languages/
@@ -13,11 +13,11 @@
 
 if (!defined('ABSPATH')) {
     exit;
 }
 
-define('WP_SIMPLE_DL_MONITOR_VERSION', '3.5.3');
+define('WP_SIMPLE_DL_MONITOR_VERSION', '3.5.4');
 define('WP_SIMPLE_DL_MONITOR_DIR_NAME', dirname(plugin_basename(__FILE__)));
 define('WP_SIMPLE_DL_MONITOR_URL', plugins_url('', __FILE__));
 define('WP_SIMPLE_DL_MONITOR_PATH', plugin_dir_path(__FILE__));
 define('WP_SIMPLE_DL_MONITOR_SITE_HOME_URL', home_url());
 define('WP_SDM_LOG_FILE', WP_SIMPLE_DL_MONITOR_PATH . 'sdm-debug-log.txt');
@@ -311,11 +311,11 @@ class simpleDownloadManager {
 
 	_e('Manually enter a valid URL of the file in the text box below, or click "Select File" button to upload (or choose) the downloadable file.', 'simple-download-monitor');
 	echo '<br /><br />';
 
 	echo '<div class="sdm-download-edit-file-url-section">';
-	echo '<input id="sdm_upload" type="text" size="100" name="sdm_upload" value="' . $old_value . '" placeholder="http://..." />';
+	echo '<input id="sdm_upload" type="text" size="100" name="sdm_upload" value="' . esc_url($old_value) . '" placeholder="http://..." />';
 	echo '</div>';
 
 	echo '<br />';
 	echo '<input id="upload_image_button" type="button" class="button-primary" value="' . __('Select File', 'simple-download-monitor') . '" />';
 
@@ -354,11 +354,11 @@ class simpleDownloadManager {
 	$old_thumbnail = get_post_meta($post->ID, 'sdm_upload_thumbnail', true);
 	$old_value = isset($old_thumbnail) ? $old_thumbnail : '';
 	_e('Manually enter a valid URL, or click "Select Image" to upload (or choose) the file thumbnail image.', 'simple-download-monitor');
 	?>
 	<br /><br />
-	<input id="sdm_upload_thumbnail" type="text" size="100" name="sdm_upload_thumbnail" value="<?php echo $old_value; ?>" placeholder="http://..." />
+	<input id="sdm_upload_thumbnail" type="text" size="100" name="sdm_upload_thumbnail" value="<?php echo esc_url($old_value); ?>" placeholder="http://..." />
 	<br /><br />
 	<input id="upload_thumbnail_button" type="button" class="button-primary" value="<?php _e('Select Image', 'simple-download-monitor'); ?>" />
 	<input id="remove_thumbnail_button" type="button" class="button" value="<?php _e('Remove Image', 'simple-download-monitor'); ?>" />
 	<br /><br />
 
@@ -399,11 +399,11 @@ class simpleDownloadManager {
 	echo '</div>';
 
 	echo '<div class="sdm-download-edit-offset-count">';
 	_e('Offset Count: ', 'simple-download-monitor');
 	echo '<br />';
-	echo ' <input type="text" size="10" name="sdm_count_offset" value="' . $value . '" />';
+	echo ' <input type="text" size="10" name="sdm_count_offset" value="' . esc_attr($value) . '" />';
 	echo '<p class="description">' . __('Enter any positive or negative numerical value; to offset the download count shown to the visitors (when using the download counter shortcode).', 'simple-download-monitor') . '</p>';
 	echo '</div>';
 
 	echo '<br />';
 	echo '<div class="sdm-download-edit-disable-logging">';
@@ -423,18 +423,18 @@ class simpleDownloadManager {
 	$version = isset($version) ? $version : '';
 
 	echo '<div class="sdm-download-edit-filesize">';
 	_e('File Size: ', 'simple-download-monitor');
 	echo '<br />';
-	echo ' <input type="text" name="sdm_item_file_size" value="' . $file_size . '" size="20" />';
+	echo ' <input type="text" name="sdm_item_file_size" value="' . esc_attr($file_size) . '" size="20" />';
 	echo '<p class="description">' . __('Enter the size of this file (example value: 2.15 MB). You can show this value in the fancy display by using a shortcode parameter.', 'simple-download-monitor') . '</p>';
 	echo '</div>';
 
 	echo '<div class="sdm-download-edit-version">';
 	_e('Version: ', 'simple-download-monitor');
 	echo '<br />';
-	echo ' <input type="text" name="sdm_item_version" value="' . $version . '" size="20" />';
+	echo ' <input type="text" name="sdm_item_version" value="' . esc_attr($version) . '" size="20" />';
 	echo '<p class="description">' . __('Enter the version number for this item if any (example value: v2.5.10). You can show this value in the fancy display by using a shortcode parameter.', 'simple-download-monitor') . '</p>';
 	echo '</div>';
 
 	wp_nonce_field('sdm_other_details_nonce', 'sdm_other_details_nonce_check');
     }
@@ -471,11 +471,11 @@ class simpleDownloadManager {
 	    return;
 	if (!isset($_POST['sdm_upload_box_nonce_check']) || !wp_verify_nonce($_POST['sdm_upload_box_nonce_check'], 'sdm_upload_box_nonce'))
 	    return;
 
 	if (isset($_POST['sdm_upload'])) {
-	    update_post_meta($post_id, 'sdm_upload', $_POST['sdm_upload']);
+	    update_post_meta($post_id, 'sdm_upload', sanitize_text_field($_POST['sdm_upload']));
 	}
     }
 
     public function sdm_save_dispatch_meta_data($post_id) { // Save "Dispatch or Redirect" metabox
 	if (defined('DOING_AUTOSAVE') && DOING_AUTOSAVE) {
@@ -494,11 +494,11 @@ class simpleDownloadManager {
 	    return;
 	if (!isset($_POST['sdm_thumbnail_box_nonce_check']) || !wp_verify_nonce($_POST['sdm_thumbnail_box_nonce_check'], 'sdm_thumbnail_box_nonce'))
 	    return;
 
 	if (isset($_POST['sdm_upload_thumbnail'])) {
-	    update_post_meta($post_id, 'sdm_upload_thumbnail', $_POST['sdm_upload_thumbnail']);
+	    update_post_meta($post_id, 'sdm_upload_thumbnail', sanitize_text_field($_POST['sdm_upload_thumbnail']));
 	}
     }
 
     public function sdm_save_statistics_meta_data($post_id) {  // Save Statistics Upload metabox
 	if (defined('DOING_AUTOSAVE') && DOING_AUTOSAVE)
@@ -526,15 +526,15 @@ class simpleDownloadManager {
 	if (!isset($_POST['sdm_other_details_nonce_check']) || !wp_verify_nonce($_POST['sdm_other_details_nonce_check'], 'sdm_other_details_nonce')) {
 	    return;
 	}
 
 	if (isset($_POST['sdm_item_file_size'])) {
-	    update_post_meta($post_id, 'sdm_item_file_size', $_POST['sdm_item_file_size']);
+	    update_post_meta($post_id, 'sdm_item_file_size', sanitize_text_field($_POST['sdm_item_file_size']));
 	}
 
 	if (isset($_POST['sdm_item_version'])) {
-	    update_post_meta($post_id, 'sdm_item_version', $_POST['sdm_item_version']);
+	    update_post_meta($post_id, 'sdm_item_version', sanitize_text_field($_POST['sdm_item_version']));
 	}
     }
 
     public function sdm_remove_view_link_cpt($action, $post) {
 
diff --git a/simple-download-monitor/readme.txt b/simple-download-monitor/readme.txt
index 855a5f0..71576a7 100644
--- a/simple-download-monitor/readme.txt
+++ b/simple-download-monitor/readme.txt
@@ -2,11 +2,11 @@
 Contributors: Tips and Tricks HQ, Ruhul Amin, josh401, mbrsolution, alexanderfoxc
 Donate link: https://www.tipsandtricks-hq.com
 Tags: download, downloads, count, counter, tracker, tracking, hits, logging, monitor, manager, files, media, digital, download monitor, download manager, downloadmanager, file manager, protect downloads, password, download category, file tree, ajax, download template, grid, documents, ip address
 Requires at least: 4.1.0
 Tested up to: 4.9
-Stable tag: 3.5.3
+Stable tag: 3.5.4
 License: GPLv2 or later
 
 Easily manage downloadable files and monitor downloads of your digital files from your WordPress site.
 
 == Description ==
@@ -172,10 +172,13 @@ Yes
 
 For screenshots please visit the [download monitor plugin page](https://www.tipsandtricks-hq.com/simple-wordpress-download-monitor-plugin)
 
 == Changelog ==
 
+= 3.5.4 =
+- Fixed stored-XSS bug. Thanks to d4wner.
+
 = 3.5.3 =
 - Added "Text Domain" and "Domain Path" to the File Header.
 
 = 3.5.2 =
 - Renamed the "langs" folder to "languages"

Vulnerable code:  * Version: 3.5.3
define('WP_SIMPLE_DL_MONITOR_VERSION', '3.5.3');
	echo '<input id="sdm_upload" type="text" size="100" name="sdm_upload" value="' . $old_value . '" placeholder="http://..." />';
	<input id="sdm_upload_thumbnail" type="text" size="100" name="sdm_upload_thumbnail" value="<?php echo $old_value; ?>" placeholder="http://..." />
	echo ' <input type="text" size="10" name="sdm_count_offset" value="' . $value . '" />';
	echo ' <input type="text" name="sdm_item_file_size" value="' . $file_size . '" size="20" />';
	echo ' <input type="text" name="sdm_item_version" value="' . $version . '" size="20" />';
	    update_post_meta($post_id, 'sdm_upload', $_POST['sdm_upload']);
	    update_post_meta($post_id, 'sdm_upload_thumbnail', $_POST['sdm_upload_thumbnail']);
	    update_post_meta($post_id, 'sdm_item_file_size', $_POST['sdm_item_file_size']);
	    update_post_meta($post_id, 'sdm_item_version', $_POST['sdm_item_version']);
Stable tag: 3.5.3
Fixed code:  * Version: 3.5.4
define('WP_SIMPLE_DL_MONITOR_VERSION', '3.5.4');
	echo '<input id="sdm_upload" type="text" size="100" name="sdm_upload" value="' . esc_url($old_value) . '" placeholder="http://..." />';
	<input id="sdm_upload_thumbnail" type="text" size="100" name="sdm_upload_thumbnail" value="<?php echo esc_url($old_value); ?>" placeholder="http://..." />
	echo ' <input type="text" size="10" name="sdm_count_offset" value="' . esc_attr($value) . '" />';
	echo ' <input type="text" name="sdm_item_file_size" value="' . esc_attr($file_size) . '" size="20" />';
	echo ' <input type="text" name="sdm_item_version" value="' . esc_attr($version) . '" size="20" />';
	    update_post_meta($post_id, 'sdm_upload', sanitize_text_field($_POST['sdm_upload']));
	    update_post_meta($post_id, 'sdm_upload_thumbnail', sanitize_text_field($_POST['sdm_upload_thumbnail']));
	    update_post_meta($post_id, 'sdm_item_file_size', sanitize_text_field($_POST['sdm_item_file_size']));
	    update_post_meta($post_id, 'sdm_item_version', sanitize_text_field($_POST['sdm_item_version']));
Stable tag: 3.5.4
= 3.5.4 =
- Fixed stored-XSS bug. Thanks to d4wner.