CVE-2022-0760

CRITICALNuclei

Simple Link Directory < 7.7.2 - Unauthenticated SQL injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0760 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 10, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Simple Link Directory

CVE List7.7.2 to < 7.7.2affected

simple_link_directory

Browse quantumcloud / simple_link_directory
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Simple Link Directory <7.7.2 - SQL injectionCVSS 9.8

WordPress Simple Link Directory plugin before 7.7.2 contains a SQL injection vulnerability. The plugin does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action, available to unauthenticated and authenticated users. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the WordPress site.

Remediation

Update to the latest version of WordPress Simple Link Directory plugin (7.7.2 or higher) to mitigate the SQL injection vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022sqliwordpresswp-pluginwpsimple-link-directoryunauthwpscanquantumcloudvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:quantumcloud:simple_link_directory:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/1c83ed73-ef02-45c0-a9ab-68a3468d2210 https://wordpress.org/plugins/simple-link-directory/ https://nvd.nist.gov/vuln/detail/CVE-2022-0760 https://plugins.trac.wordpress.org/changeset/2684915 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3