CVE-2022-0827

CRITICALNuclei

Bestbooks <= 2.6.3 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0827 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 30, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

Bestbooks

CVE List2.6.3 to ≤ 2.6.3affected

bestbooks

Browse presspage / bestbooks
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Best Books <=2.6.3 - SQL InjectionCVSS 9.8

WordPress Best Books plugin through 2.6.3 is susceptible to SQL injection. The plugin does not sanitize and escape some parameters before using them in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

An attacker can exploit this vulnerability to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.

Remediation

Update to WordPress Best Books plugin version 2.6.3 or later to fix the SQL injection vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022sqliwpscanwordpresswp-pluginwpbestbooksunauthenticatedpresspagevkev
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:presspage:bestbooks:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/0d208ebc-7805-457b-aa5f-ffd5adb2f3be https://wordpress.org/plugins/bestbooks/ https://nvd.nist.gov/vuln/detail/CVE-2022-0827 https://github.com/ARPSyndicate/cvemon https://github.com/cyllective/CVEs

Source: ProjectDiscovery

References

2