CVE-2022-0773

CRITICALNuclei

Documentor <= 1.5.3 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0773 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Documentor – Create Product Documentation

CVE List1.5.3 to ≤ 1.5.3affected

Nuclei templates

1
ProjectDiscoveryCRITICALDocumentor <= 1.5.3 - Unauthenticated SQL InjectionCVSS 9.8

The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Update to Documentor version 1.5.3 or later to mitigate this vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicve2022cveunauthsqliwp-pluginwpdocumentor-litewpscanwordpressdocumentor_projectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:documentor_project:documentor:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/55b89de0-30ed-4f98-935e-51f069faf6fc https://wordpress.org/plugins/documentor-lite/ https://nvd.nist.gov/vuln/detail/CVE-2022-0773

Source: ProjectDiscovery

References

2