CVE-2022-0781

CRITICALNuclei

Nirweb support < 2.8.2 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0781 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 17, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Nirweb support

CVE List2.8.2 to < 2.8.2affected

nirweb_support

Browse nirweb / nirweb_support
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Nirweb Support <2.8.2 - SQL InjectionCVSS 9.8

WordPress Nirweb support plugin before 2.8.2 contains a SQL injection vulnerability. The plugin does not sanitize and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information from a database, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Update to the latest version of the WordPress Nirweb Support plugin (2.8.2 or higher) to mitigate the SQL Injection vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagscve2022cvewordpresswp-pluginwpsqliwpscannirweb-supportunauthnirwebvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:nirweb:nirweb_support:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/1a8f9c7b-a422-4f45-a516-c3c14eb05161 https://wordpress.org/plugins/nirweb-support/ https://nvd.nist.gov/vuln/detail/CVE-2022-0781 https://github.com/cyllective/CVEs https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

2