PT-2022-13082 · WordPress · Adrotate

Jrxnm + 1 · Published 2022-03-07 · Updated 2022-03-11 · CVE-2022-0267

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AdRotate WordPress plugin versions prior to 5.8.22

Description The issue concerns a SQL injection problem. It occurs because the adrotate action is not properly sanitized and escaped before being used in a SQL statement via the adrotate request action function, which is accessible to administrators. This function is used to handle actions related to ad rotation.

Recommendations For versions prior to 5.8.22, update to version 5.8.22 or later to resolve the issue. As a temporary workaround, consider restricting access to the adrotate request action function to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-0267

Affected Products

Adrotate

References · 4

• 🔥 https://wpscan.com/vulnerability/7df70f49-547f-4bdb-bf9b-2e06f93488c6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0267 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0267 · Vendor Advisory
• https://t.me/cvenotify/27813 · Telegram Post