CVE-2022-0846

CRITICALNuclei

SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0846 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 30, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

Affected products and versions

2
ProductSourceVersion range

SpeakOut! Email Petitions

CVE List2.14.15.1 to < 2.14.15.1affected

speakout\!_email_petitions

Browse speakout\!_email_petitions_project / speakout\!_email_petitions
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALSpeakOut Email Petitions < 2.14.15.1 - SQL InjectionCVSS 9.8

The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Remediation

Fixed in version 2.14.15.1

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022wordpresswp-pluginwpunauthwpscansqlispeakoutspeakout-email-petitionsspeakout\!_email_petitions_project
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:speakout\!_email_petitions_project:speakout\!_email_petitions:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/b030296d-688e-44a4-a48a-140375f2c5f4 https://wordpress.org/plugins/speakout/ https://nvd.nist.gov/vuln/detail/CVE-2022-0846 https://github.com/ARPSyndicate/cvemon https://github.com/DharmaDoll/Search-Poc-from-CVE

Source: ProjectDiscovery

References

2