CVE-2022-0826

CRITICALNuclei

WP Video Gallery <= 1.7.1 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0826 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The WP Video Gallery WordPress plugin through 1.7.1 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 30, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

WP Video Gallery

CVE List1.7.1 to ≤ 1.7.1affected

wp-video-gallery-free

Browse wp-video-gallery-free_project / wp-video-gallery-free
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress WP Video Gallery <=1.7.1 - SQL InjectionCVSS 9.8

WordPress WP Video Gallery plugin through 1.7.1 contains a SQL injection vulnerability. The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or further compromise of the WordPress site.

Remediation

Update to the latest version of WP Video Gallery plugin (>=1.7.2) or apply the vendor-provided patch to mitigate the SQL Injection vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022wp-pluginwpscanwordpresswpsqliwp-video-gallery-freeunauthwp-video-gallery-free_projectvkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:wp-video-gallery-free_project:wp-video-gallery-free:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/7a3eed3b-c643-4e24-b833-eba60ab631c5 https://wordpress.org/plugins/wp-video-gallery-free/ https://nvd.nist.gov/vuln/detail/CVE-2022-0826 https://github.com/ARPSyndicate/kenzer-templates https://github.com/cyllective/CVEs

Source: ProjectDiscovery

References

2