PT-2022-13598 · WordPress · Podcast Importer Secondline

Yicheng Liu · Published 2022-04-11 · Updated 2022-04-15 · CVE-2022-1023

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Podcast Importer SecondLine WordPress plugin versions prior to 1.3.8

Description The issue is related to the improper sanitization and escaping of some imported data, which could allow SQL injection attacks to be performed by importing a malicious podcast file. This could potentially lead to unauthorized access or manipulation of database content.

Recommendations For versions prior to 1.3.8, update to version 1.3.8 or later to resolve the issue. As a temporary workaround, consider restricting the import of podcast files from untrusted sources to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-1023

Affected Products

Podcast Importer Secondline

References · 6

• 🔥 https://wpscan.com/vulnerability/163069cd-98a8-4cfb-8b58-a6727a7d5c48 · Exploit
• https://osv.dev/vulnerability/CVE-2022-1023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1023 · Security Note
• https://plugins.trac.wordpress.org/changeset/2696254 · Patch
• https://t.me/cvenotify/28707 · Telegram Post
• https://t.me/cibsecurity/40469 · Telegram Post