CVE-2022-0949

CRITICALNuclei

WP Block and Stop Bad Bots < 6.930 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-0949 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection

CVE List6.930 to < 6.930affected

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Stop Bad Bots <6.930 - SQL InjectionCVSS 9.8

WordPress Stop Bad Bots plugin before 6.930 contains a SQL injection vulnerability. The plugin does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.

Remediation

Fixed in version 6.930.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022stopbadbotswp-pluginwpunauthwpscansqliwordpressvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:stopbadbots:block_and_stop_bad_bots:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/a0fbb79a-e160-49df-9cf2-18ab64ea66cb https://wordpress.org/plugins/stopbadbots/ https://nvd.nist.gov/vuln/detail/CVE-2022-0949 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2