Plugin inspection:

Pods – Custom Content Types and Fields

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Warnings

This recommendation applies to version 2.3.18 of this plugin, but the most recent version is 3.2.7.1. These findings may no longer be correct.

Findings

  • Note that this plugin is very large at 32k lines
  • The plugin is very likely to have arbitrary code exploits
  • The plugin has SQL injections as a documented feature – you can click a button and a form will pop-up asking you what SQL you want to inject, and insert a shortcode with your SQL into the post: [pods name=”alert1″ where=”sleep(999)”]abc[/pods]
  • Contains many instances of eval()

If you choose to deploy this plugin, we recommend that you set PODS_DISABLE_EVAL to true, which will prevent a large class of potential attacks against this plugin.

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

Contains SQL injections (intentionally). Probably contains arbitrary code execution vulnerabilities due to the amount of eval() calls.

Failure criteria

  • Lack of input sanitisation
  • Execution of unprepared SQL statements
  • Unsafe generation of PHP code
  • Failure to use available core functionality
  • Very large codebase

Read more about our failure criteria.