PT-2022-13438 · WordPress · Daily Prayer Time

Cydave · Published 2022-04-18 · Updated 2022-04-27 · CVE-2022-0785

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Daily Prayer Time WordPress plugin versions prior to 2022.03.01

Description The issue concerns an unauthenticated SQL injection. It occurs because the month parameter is not properly sanitized and escaped before being used in a SQL statement via the "get monthly timetable" AJAX action, which is accessible to unauthenticated users.

Recommendations For versions prior to 2022.03.01, update to version 2022.03.01 or later to resolve the issue. As a temporary workaround, consider restricting access to the "get monthly timetable" AJAX action to authenticated users only until a patch is applied. Avoid using the month parameter in the affected AJAX endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-0785

Affected Products

Daily Prayer Time

References · 4

• 🔥 https://wpscan.com/vulnerability/e1e09f56-89a4-4d6f-907b-3fb2cb825255 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-0785 · Security Note
• https://osv.dev/vulnerability/CVE-2022-0785 · Vendor Advisory
• https://t.me/cibsecurity/41060 · Telegram Post