Description

Unauthenticated SQL Injection in Total Donations <= 2.0.5 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.3",
  "pubDate": "2026-08-19T13:18:08.547Z",
  "pubdate": "2026-08-19T13:18:08.547Z",
  "executiveSummary": "An unauthenticated SQL injection vulnerability has been identified in the Total Donations plugin for versions <= 2.0.5. This security flaw allows remote, unauthenticated attackers to manipulate database queries by injecting arbitrary SQL commands into vulnerable application parameters. The primary impact of this vulnerability includes unauthorized access to sensitive backend database contents, potential data exfiltration, and possible database compromise. The affected product is the Total Donations <= 2.0.5 software, which lacks proper input sanitization and parameterization of user-supplied data before passing it to the underlying database management system. Risk implications are severe, as exploitation requires no prior authentication or administrative privileges, lowering the barrier to entry for malicious actors. Attackers can leverage network exposure to interact directly with the vulnerable endpoints and execute malicious payloads. Remediation requires updating the affected software to a patched version once available, or implementing strict input validation and parameterized queries to neutralize the injection vector.",
  "technicalDetails": "The vulnerability resides in the data handling mechanisms of the Total Donations plugin, specifically within versions <= 2.0.5, where user-supplied input is insufficiently sanitized, validated, or escaped before being concatenated directly into database queries. This root cause violates secure coding principles regarding SQL query construction, bypassing the abstraction layers provided by secure database APIs or prepared statements.\nThe exploitation method relies on supplying crafted input containing malicious SQL syntax through vulnerable HTTP request parameters. Because the application processes these requests without authentication requirements or privilege checks, any remote attacker operating across the network can interact with the vulnerable component.\nThe step-by-step attack flow begins when an unauthenticated attacker crafts a malicious HTTP request containing SQL injection payloads targeting specific input parameters processed by the Total Donations plugin. Upon receiving the request, the vulnerable component extracts the input and dynamically constructs a SQL query string by concatenating the raw data directly into the query statement. The database management system then parses and executes the resulting malicious query as part of its routine operations.\nThe payload behavior allows the attacker to manipulate the logical structure of the SQL query. Depending on the injection vector, this permits the extraction of sensitive information from the database via techniques such as UNION-based queries, error-based extraction, or blind boolean/time-based inferences. The post-exploitation impact includes full read access to underlying database tables containing donor information, administrative credentials, and other proprietary application data, potentially leading to broader system compromise."
}