PT-2022-13429 · WordPress · Documentor

Cydave · Published 2022-05-02 · Updated 2022-05-09 · CVE-2022-0773

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Documentor WordPress plugin versions 1.5.3 and earlier

Description The issue arises from the failure to sanitize and escape user input before it is interpolated in an SQL statement and then executed, leading to an SQL Injection that can be exploited by unauthenticated users.

Recommendations For Documentor WordPress plugin versions 1.5.3 and earlier, update to a version that addresses this issue, as the current version is exploitable to SQL Injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-0773

Affected Products

Documentor

References · 4

• 🔥 https://wpscan.com/vulnerability/55b89de0-30ed-4f98-935e-51f069faf6fc · Exploit
• https://osv.dev/vulnerability/CVE-2022-0773 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0773 · Security Note
• https://t.me/cibsecurity/41751 · Telegram Post