CVE-2022-2840

CRITICAL

Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-2840 has a selected CVSS score of 9.8 (critical); EIP currently links 1 catalogued exploit.

Description

The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

Affected products and versions

1
ProductSourceVersion range

Zephyr Project Manager

CVE List3.2.5 to < 3.2.5affected

Proofs of concept

1

Catalogued exploits

ExploitDBWordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLiExploitDB exploitby Rizacan TufanNot analyzed1 file
ExploitDB
PoC details

References

3