CVE-2022-0349

CRITICALNuclei

NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0349 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor

CVE List2.3.9 to < 2.3.9affected

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress NotificationX <2.3.9 - SQL InjectionCVSS 9.8

WordPress NotificationX plugin prior to 2.3.9 contains a SQL injection vulnerability. The plugin does not sanitize and escape the nx_id parameter before using it in a SQL statement, leading to an unauthenticated blind SQL injection. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation.

Remediation

Update to the latest version of the WordPress NotificationX plugin (2.3.9 or higher) to mitigate the SQL Injection vulnerability.

WeaknessesCWE-89
Authorsedoardottt
Template tagstime-based-sqlicvecve2022wordpresswp-pluginwpsqlinotificationxwpscanwpdevelopervuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:wpdeveloper:notificationx:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/1d0dd7be-29f3-4043-a9c6-67d02746463a https://wordpress.org/plugins/notificationx/advanced/ https://nvd.nist.gov/vuln/detail/CVE-2022-0349 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2