Description

Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-13T14:16:57.813Z",
  "pubdate": "2026-08-13T14:16:57.813Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability exists in the Web Directory Free plugin affecting versions 1.7.13 and prior. This security flaw allows remote, unauthenticated attackers to manipulate database queries by injecting malicious SQL payloads directly into vulnerable application parameters. The impact of successful exploitation includes unauthorized access to sensitive backend database contents, potential data exfiltration, and possible complete compromise of the underlying database architecture. The vulnerability stems from insufficient input sanitization and lack of parameterization within the affected component of the Web Directory Free product. Exploitation requires network access to the target web application, but requires no prior authentication or administrative privileges, significantly lowering the attack barrier for malicious threat actors. Risk implications are severe, as unauthorized database access can lead to the exposure of Personally Identifiable Information (PII), application credentials, and operational data. Organizations utilizing vulnerable versions of Web Directory Free face high exposure to automated scanning and direct exploitation attempts.",
  "technicalDetails": "The vulnerability is an unauthenticated SQL injection flaw residing in Web Directory Free versions 1.7.13 and below. The root cause of the issue is the improper neutralization of special elements within user-supplied input before it is utilized in dynamic database queries. Specifically, the vulnerable component fails to properly sanitize or parameterize input parameters handled by the application logic, allowing malicious SQL syntax to alter the intended query structure logic.\nThe attack flow begins when an unauthenticated remote attacker crafts a specialized HTTP request containing malicious SQL injection payloads targeting vulnerable input fields or parameters exposed by the Web Directory Free plugin. Because the application processes this input without adequate validation or prepared statements, the injected SQL commands are concatenated directly into database queries executed against the backend database management system (DBMS).\nNetwork exposure is fully external, as the vulnerable parameters are accessible over standard web protocols (HTTP/HTTPS) without requiring any pre-existing user session, cookie, or authentication tokens. Privilege requirements are entirely absent, permitting any anonymous user on the network to interact with the vulnerable endpoint and trigger the flaw.\nThe payload behavior alters the logical evaluation of the database query, enabling techniques such as UNION-based extraction, boolean-based blind inference, or time-based blind SQL injection to enumerate database structures, extract administrative hashes, read system files accessible to the database user, or modify database records depending on database configurations and user privileges.\nPost-exploitation impact includes full read and write access to the database tables managed by the Web Directory Free plugin, potential escalation of privileges if database accounts possess excessive permissions, and overall integrity compromise of the web application data layer."
}