nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2022-1950 CVE-2022-1950
CRITICALNuclei
Youzify < 1.2.0 - Unauthenticated SQLi
Record summary
CVE-2022-1950 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.
Description
The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Dec 23, 2023 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
- Nuclei templates
- 1
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress | CVE List | 1.2.0 to < 1.2.0 | affected |
youzifyBrowse kainelabs / youzify | VulnCheck | Version data not supplied | |
Nuclei templates
1ProjectDiscoveryCRITICALYouzify < 1.2.0 - Unauthenticated SQLiCVSS 9.8
The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection
Impact
Unauthenticated attackers can execute time-based blind SQL injection via AJAX actions to extract database contents, potentially exposing all Youzify media and user data.
Remediation
Fixed in 1.2.0
WeaknessesCWE-89
AuthorsDhiyaneshDK
Template tagscvecve2022youzifywpwp-pluginwordpresssqlitime-based-sqlivkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:kainelabs:youzify:*:*:*:*:*:wordpress:*:*
FOFA: body="/wp-content/plugins/youzify"
Source: ProjectDiscovery
References
2wpscan.com
https://wpscan.com/vulnerability/4352283f-dd43-4827-b417-0c55d0f4637d