PT-2022-13623 · WordPress · Pricing Deals For Woocommerce

King + 1 · Published 2022-07-11 · Updated 2022-07-15 · CVE-2022-1057

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pricing Deals for WooCommerce WordPress plugin versions 2.0.2.02 and earlier

Description The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.

Recommendations For Pricing Deals for WooCommerce WordPress plugin versions 2.0.2.02 and earlier, update to a version later than 2.0.2.02 to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-1057

Affected Products

Pricing Deals For Woocommerce

References · 4

• 🔥 https://wpscan.com/vulnerability/7c33ffc3-84d1-4a0f-a837-794cdc3ad243 · Exploit
• https://osv.dev/vulnerability/CVE-2022-1057 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1057 · Security Note
• https://t.me/cibsecurity/45906 · Telegram Post