CVE-2022-1768

CRITICALNuclei

RSVPMaker <= 9.3.2 - Unauthenticated SQL Injection

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-1768 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2. Please note that this is separate from CVE-2022-1453 & CVE-2022-1505.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Dec 20, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 20, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

rsvpmaker

Browse carrcommunications / rsvpmaker
VulnCheckVersion data not supplied

RSVPMaker

Browse davidfcarr / RSVPMaker

Default status: unaffected

CVE ListThrough 9.3.2affected

Nuclei templates

1
ProjectDiscoveryHIGHWordPress RSVPMaker <=9.3.2 - SQL InjectionCVSS 7.5

WordPress RSVPMaker plugin through 9.3.2 contains a SQL injection vulnerability due to insufficient escaping and parameterization on user-supplied data passed to multiple SQL queries in ~/rsvpmaker-email.php. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation.

Remediation

Update to the latest version of the RSVPMaker plugin (9.3.3 or higher) to mitigate the SQL Injection vulnerability.

WeaknessesCWE-89
Authorsedoardottt
Template tagstime-based-sqlicvecve2022wordpresswp-pluginwpsqlirsvpmakercarrcommunicationsvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:carrcommunications:rsvpmaker:*:*:*:*:*:wordpress:*:*
https://gist.github.com/Xib3rR4dAr/441d6bb4a5b8ad4b25074a49210a02cc https://wordpress.org/plugins/rsvpmaker/ https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2725322%40rsvpmaker&new=2725322%40rsvpmaker&sfp_email=&sfph_mail= https://nvd.nist.gov/vuln/detail/CVE-2022-1768 https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1768

Source: ProjectDiscovery

References

6