PT-2022-15410 · WordPress · Request A Quote

Benachi · Published 2022-07-25 · Updated 2022-07-29 · CVE-2022-2240

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Request a Quote WordPress plugin versions 2.3.7 and earlier

Description The issue allows unauthenticated users to attach a malicious CSV file to a quote. This could lead to a CSV injection once an admin downloads and opens it. The problem arises from the lack of validation for uploaded CSV files.

Recommendations For versions 2.3.7 and earlier, update to a version that includes the fix for this issue, as the current version does not validate uploaded CSV files, posing a risk of CSV injection. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2022-2240

Affected Products

Request A Quote

References · 4

• 🔥 https://wpscan.com/vulnerability/6a3a573e-f9f2-45ec-9156-332cc551fc7e · Exploit
• https://osv.dev/vulnerability/CVE-2022-2240 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2240 · Security Note
• https://t.me/cibsecurity/46889 · Telegram Post