CVE-2022-4117

CRITICALNuclei

IWS - Geo Form Fields <= 1.0 - Unauthenticated SQLi

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2022-4117 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Nov 13, 2023 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 14, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

IWS

Default status: affected

CVE ListThrough 1.0affected

iws-geo-form-fields

Browse iws-geo-form-fields_project / iws-geo-form-fields
VulnCheckVersion data not supplied

Nuclei templates

1
ProjectDiscoveryCRITICALWordPress IWS Geo Form Fields <=1.0 - SQL InjectionCVSS 9.8

WordPress IWS Geo Form Fields plugin through 1.0 contains a SQL injection vulnerability. The plugin does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or further compromise of the affected WordPress site.

Remediation

Update to the latest version of the WordPress IWS Geo Form Fields plugin (>=1.1) or apply the vendor-supplied patch to mitigate the SQL Injection vulnerability.

WeaknessesCWE-89
Authorstheamanrawat
Template tagstime-based-sqlicvecve2022sqliwordpresswp-pluginwpiws-geo-form-fieldswpscaniws-geo-form-fields_projectvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:iws-geo-form-fields_project:iws-geo-form-fields:*:*:*:*:*:wordpress:*:*
https://wpscan.com/vulnerability/1fac3eb4-13c0-442d-b27c-7b7736208193 https://wordpress.org/plugins/iws-geo-form-fields/ https://nvd.nist.gov/vuln/detail/CVE-2022-4117 https://github.com/ARPSyndicate/cvemon https://github.com/cyllective/CVEs

Source: ProjectDiscovery

References

2