CVE-2022-0784

CRITICALNuclei

Title Experiments Free < 9.0.1 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0784 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 27, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Title Experiments Free

CVE List9.0.1 to < 9.0.1affected

title_experiments_free

Browse title_experiments_free_project / title_experiments_free
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Title Experiments Free <9.0.1 - SQL InjectionCVSS 9.8

WordPress Title Experiments Free plugin before 9.0.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action, available to unauthenticated users. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.

Remediation

Update to the latest version of WordPress Title Experiments Free plugin (9.0.1 or higher) to mitigate the vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicve2022cvewpscanwp-pluginwpsqliwp-experiments-freeunauthwordpresstitle_experiments_free_projectvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:title_experiments_free_project:title_experiments_free:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/6672b59f-14bc-4a22-9e0b-fcab4e01d97f https://wordpress.org/plugins/wp-experiments-free/ https://nvd.nist.gov/vuln/detail/CVE-2022-0784 https://github.com/cyllective/CVEs https://github.com/superlink996/chunqiuyunjingbachang

Source: ProjectDiscovery

References

2