CVE-2022-0651

CRITICALNuclei

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_type

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0651 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 31, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WP Statistics

Browse WP Statistics / WP Statistics
CVE List13.1.5 to ≤ 13.1.5affected

Nuclei templates

1
ProjectDiscoveryHIGHWordPress Plugin WP Statistics <= 13.1.5 - SQL InjectionCVSS 7.5

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Impact

Unauthenticated attackers can exploit time-based blind SQL injection to extract sensitive database contents including user credentials and statistics data.

Remediation

Update wp-statistics plugin to version 13.1.6, or newer.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022sqliwpwordpresswp-pluginwp-statisticsveronalabsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/wp-statistics/
FOFA: body=/wp-content/plugins/wp-statistics/
Google: inurl:/wp-content/plugins/wp-statistics
https://wordpress.org/plugins/wp-statistics/ https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 https://nvd.nist.gov/vuln/detail/CVE-2022-0651 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0651

Source: ProjectDiscovery

References

4