PT-2022-13163 · WordPress · Asgaros Forum

Krzysztof Zając · Published 2022-02-28 · Updated 2022-03-08 · CVE-2022-0411

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Asgaros Forum WordPress plugin versions prior to 2.0.0

Description The issue concerns a SQL injection problem. It occurs because the post id parameter is not properly sanitised and escaped before being used in a SQL statement via a REST route of the plugin. This REST route is accessible to any authenticated user.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-0411

Affected Products

Asgaros Forum

References · 4

• 🔥 https://wpscan.com/vulnerability/35272197-c973-48ad-8405-538bfbafa172 · Exploit
• https://osv.dev/vulnerability/CVE-2022-0411 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0411 · Security Note
• https://plugins.trac.wordpress.org/changeset/2669226/asgaros-forum · Note