PT-2022-13444 · WordPress · Badgeos

Cydave · Published 2022-05-09 · Updated 2022-05-16 · CVE-2022-0817

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BadgeOS WordPress plugin versions 3.7.0 and earlier

Description The issue concerns an SQL Injection that can be exploited by unauthenticated users. This occurs because a parameter is not properly sanitised and escaped before being used in a SQL statement via an AJAX action.

Recommendations For BadgeOS WordPress plugin versions 3.7.0 and earlier, update to a version later than 3.7.0 to resolve the issue. As a temporary workaround, consider restricting access to the AJAX action that leads to the SQL Injection until a patch is available.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-0817

Affected Products

Badgeos

References · 4

• 🔥 https://wpscan.com/vulnerability/69263610-f454-4f27-80af-be523d25659e · Exploit
• https://osv.dev/vulnerability/CVE-2022-0817 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0817 · Security Note
• https://t.me/cibsecurity/42191 · Telegram Post