CVE-2022-0769

CRITICALNuclei

Users Ultra <= 3.1.0 - Unauthenticated SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0769 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 30, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Users Ultra Membership, Users Community and Member Profiles With PayPal Integration Plugin

CVE List3.1.0 to ≤ 3.1.0affected

users_ultra

Browse usersultra / users_ultra
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALUsers Ultra <= 3.1.0 - SQL InjectionCVSS 9.8

The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.

Remediation

Update to Users Ultra version 3.1.0 or later to mitigate this vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022wpusers-ultrawpscansqliwordpresswp-pluginusersultravkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:usersultra:users_ultra:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/05eab45d-ebe9-440f-b9c3-73ec40ef1141 https://wordpress.org/plugins/users-ultra/ https://nvd.nist.gov/vuln/detail/CVE-2022-0769 https://github.com/ARPSyndicate/cvemon https://github.com/cyllective/CVEs

Source: ProjectDiscovery

References

2