CVE-2022-1013

CRITICALNuclei

Personal Dictionary < 1.3.4 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-1013 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Affected products and versions

1
ProductSourceVersion range

Personal Dictionary

CVE List1.3.4 to < 1.3.4affected

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress Personal Dictionary <1.3.4 - Blind SQL InjectionCVSS 9.8

WordPress Personal Dictionary plugin before 1.3.4 contains a blind SQL injection vulnerability. The plugin fails to properly sanitize user-supplied POST data before being interpolated in an SQL statement and executed. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to extract sensitive information from the database.

Remediation

Fixed in version 1.3.4.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022wpunauthwpscansqliwordpresswp-pluginpersonal-dictionaryays-provuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:ays-pro:personal_dictionary:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/eed70659-9e3e-42a2-b427-56c52e0fbc0d https://wordpress.org/plugins/personal-dictionary/ https://nvd.nist.gov/vuln/detail/CVE-2022-1013 https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

2