CVE-2022-25149

CRITICALNuclei

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via IP

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-25149 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 31, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

WP Statistics

Browse WP Statistics / WP Statistics
CVE List13.1.5 to ≤ 13.1.5affected

Nuclei templates

1
ProjectDiscoveryHIGHWordPress Plugin WP Statistics <= 13.1.5 - SQL InjectionCVSS 7.5

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Impact

Unauthenticated attackers can execute time-based blind SQL injection through the IP parameter to extract sensitive database information including user credentials, posts, comments, and WordPress configuration data.

Remediation

Update WP Statistics plugin to version 13.1.6 or later that properly escapes and parameterizes the IP parameter.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicve2022cvesqliwpscanwordpresswp-pluginwpwp-statisticsveronalabsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*
Shodan: http.html:/wp-content/plugins/wp-statistics/
FOFA: body=/wp-content/plugins/wp-statistics/
Google: inurl:/wp-content/plugins/wp-statistics
https://wordpress.org/plugins/wp-statistics/ https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 https://nvd.nist.gov/vuln/detail/CVE-2022-25149 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25149

Source: ProjectDiscovery

References

4