Full Report
Critical Fancy Product Designer plugin flaws risk remote code execution and SQL injection attacks on WordPress sites
Analysis Summary
# Vulnerability: Fancy Product Designer Plugin - Arbitrary File Upload & SQL Injection
## CVE Details
- CVE ID: CVE-2024-51919 (Arbitrary File Upload)
- CVE ID: CVE-2024-51818 (SQL Injection)
- CVSS Score: Not explicitly provided in the text, but both findings imply High/Critical severity due to RCE/Database compromise potential.
- CWE: CWE-434 (Unrestricted Upload of File with Dangerous Type) for CVE-2024-51919; CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')) for CVE-2024-51818.
## Affected Systems
- Products: Fancy Product Designer premium plugin for WordPress (developed by Radykal)
- Versions: Up to and including version 6.4.3.
- Configurations: WordPress websites utilizing the listed plugin version.
## Vulnerability Description
Two critical, unauthenticated vulnerabilities were discovered in the Fancy Product Designer plugin:
1. **CVE-2024-51919 (Arbitrary File Upload):** Flaws in the `save_remote_file` and `fpd_admin_copy_file` functions allow unauthenticated users to upload arbitrary files, including PHP files. This directly enables high-impact Remote Code Execution (RCE).
2. **CVE-2024-51818 (SQL Injection):** The `get_products_sql_attrs` function insufficiently sanitizes user input, relying only on the ineffective `strip_tags` function against injection. This allows unauthenticated users to execute arbitrary SQL queries against the WordPress database.
## Exploitation
- Status: Not explicitly stated as exploited in the wild, but given the public disclosure, exploitation is likely. PoC availability is implied by the research finding.
- Complexity: Low (due to being unauthenticated).
- Attack Vector: Network (Remote exploitation possible).
## Impact
- Confidentiality: High (SQLi can lead to data exfiltration; RCE grants access to site files/database credentials).
- Integrity: High (RCE allows full system modification; SQLi allows data modification).
- Availability: High (RCE can lead to site defacement or complete shutdown).
## Remediation
### Patches
- No patched version number is explicitly mentioned in the text. The vulnerabilities remain unpatched in version 6.4.3 as of the disclosure date (Jan 8, 2025). Users must await an official update from the vendor (Radykal).
### Workarounds
- **Deactivate or remove the Fancy Product Designer plugin immediately** until a security patch is released and verified.
## Detection
- Detection strategies focus on input validation failures:
1. **File Upload Monitoring:** Monitor for unexpected file uploads (especially `.php` files) targeting plugin directories within the WordPress installation.
2. **Database Query Monitoring:** Look for unusual or complex SQL queries originating from unauthenticated requests targeting the functions mentioned (`save_remote_file`, `fpd_admin_copy_file`, `get_products_sql_attrs`).
- **Developer Mitigation Advice (Proactive Detection):** Implement strict input validation, use whitelisting for file extensions, and utilize prepared statements for all SQL operations.
## References
- Vendor Advisories: Vendor (Radykal) had not responded to researcher contact on March 18, 2024, as of the January 2025 disclosure date.
- Relevant links:
- Article Source: defanged-infosecurity-magazine-com/news/fancy-product-designer-plugin-flaws/