PT-2022-13339 · WordPress · Ad Injection

Asif Nawaz Minhas · Published 2022-04-18 · Updated 2022-04-27 · CVE-2022-0661

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ad Injection WordPress plugin versions 1.2.0.19 and earlier

Description The issue allows a high privileged user to inject arbitrary HTML or javascript into the pages, leading to a stored cross-site scripting (XSS) vulnerability. It is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW FILE EDIT and DISALLOW FILE MOD constants are both set.

Recommendations For Ad Injection WordPress plugin versions 1.2.0.19 and earlier, update to a version later than 1.2.0.19 to resolve the issue. As a temporary workaround, consider restricting the unfiltered html capability to prevent high privileged users from injecting arbitrary HTML or javascript. Restrict access to the plugin's advert injection functionality to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-0661

Affected Products

Ad Injection

References · 4

• 🔥 https://wpscan.com/vulnerability/3c5a7b03-d4c3-46b9-af65-fb50e58b0bfd · Exploit
• https://osv.dev/vulnerability/CVE-2022-0661 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0661 · Security Note
• https://t.me/cibsecurity/41064 · Telegram Post