CVE-2022-25148

Опубликовано: 24 фев. 2022

Источник: nvd

CVSS3: 9.8

CVSS3: 7.5

CVSS2: 5

EPSS Средний

Описание

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Ссылки

http://packetstormsecurity.com/files/174482/WordPress-WP-Statistics-13.1.5-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042
Exploit
Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=
Patch
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25148
Third Party Advisory
http://packetstormsecurity.com/files/174482/WordPress-WP-Statistics-13.1.5-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042
Exploit
Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=
Patch
Third Party Advisory
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25148
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:*

Версия до 13.1.5 (включая)

EPSS

Процентиль: 98%

0.48461

Средний

9.8 Critical

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-wg9m-p2x3-fg97

CVSS3: 9.8

github

почти 4 года назад

EPSS

Процентиль: 98%

0.48461

Средний

9.8 Critical

CVSS3

7.5 High

CVSS3

5 Medium

CVSS2

Дефекты

CWE-89