PT-2022-14046 · WordPress · The Note Press

Daniel Krohmer + 1 · Published 2022-06-06 · Updated 2022-06-15 · CVE-2022-1688

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions The Note Press WordPress plugin versions 0.1.10 and earlier

Description The issue concerns a lack of sanitization and escaping of the id parameter, which is used in SQL statements via the admin dashboard. This leads to SQL injections.

Recommendations For The Note Press WordPress plugin versions 0.1.10 and earlier, update to a version that properly sanitizes and escapes the id parameter to prevent SQL injections. As a temporary workaround, consider restricting access to the admin dashboard to minimize the risk of exploitation.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-1688

Affected Products

The Note Press

References · 5

• 🔥 https://wpscan.com/vulnerability/63d4444b-9b04-47f5-a692-c6c6c8ea7d92 · Exploit
• 🔥 https://bulletin.iese.de/post/note-press_0-1-10_1 · Exploit
• https://osv.dev/vulnerability/CVE-2022-1688 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1688 · Security Note
• https://t.me/cibsecurity/43997 · Telegram Post