Premium Packages: SQL injection via orderby parameter (CVE-2025-24659)

CVE-2025-24659 is a SQL injection vulnerability identified in the WordPress plugin 'Premium Packages - Sell Digital Products Securely' (versions 5.9.6 and below). The vulnerability stems from insufficient sanitization of the 'orderby' URL parameter within the plugin's order management dashboard (/wp-admin/edit.php?post_type=wpdmpro&page=orders). Successful exploitation requires administrator privileges and the presence of the base 'Download Manager' plugin. Attackers can utilize time-based blind SQL injection techniques to extract sensitive information from the underlying database.

Attack Chain

1. Attacker authenticates to the target WordPress site with administrator credentials.
2. Attacker navigates to the Premium Packages order list dashboard.
3. Attacker crafts a malicious HTTP GET or POST request targeting /wp-admin/edit.php.
4. Attacker injects time-based SQL payloads (e.g., SLEEP()) into the orderby parameter.
5. The application passes the unsanitized orderby value into SQL queries within list-orders.php.
6. The backend executes the injected SQL command, causing time delays based on the success of Boolean conditions.
7. Attacker measures response latency to infer database content character by character.

Impact

Successful exploitation allows an authenticated administrator to exfiltrate information from the site's database via time-based blind SQL injection.

Recommendation

1. Upgrade the 'Premium Packages - Sell Digital Products Securely' plugin to a version above 5.9.6 immediately.
2. Audit administrator accounts for unauthorized activity or unexpected login patterns, as this vulnerability requires elevated privileges.
3. Implement WAF rules to sanitize or block requests containing suspicious SQL keywords (e.g., SLEEP, SUBSTR, IF) within the orderby parameter on the specified plugin dashboard path.