PT-2022-14042 · WordPress · The Cube Slider

Daniel Krohmer + 1 · Published 2022-06-06 · Updated 2022-06-15 · CVE-2022-1684

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions The Cube Slider WordPress plugin versions 1.2 and earlier

Description The issue concerns a lack of sanitization and escaping of the idslider parameter, which is used in various SQL queries. This leads to SQL injections that can be exploited by high-privileged users, such as administrators.

Recommendations For The Cube Slider WordPress plugin versions 1.2 and earlier, update to a version that properly sanitizes and escapes the idslider parameter to prevent SQL injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-1684

Affected Products

The Cube Slider

References · 5

• 🔥 https://bulletin.iese.de/post/cube-slider_1-2 · Exploit
• 🔥 https://wpscan.com/vulnerability/db7fb815-945a-41c7-8932-834cc646a806 · Exploit
• https://osv.dev/vulnerability/CVE-2022-1684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1684 · Security Note
• https://t.me/cibsecurity/43996 · Telegram Post