PT-2022-20737 · WordPress · Nex-Forms

Elias Hohl · Published 2022-09-19 · Updated 2023-03-27 · CVE-2022-3142

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NEX-Forms WordPress plugin versions prior to 7.9.7

Description The issue arises from the plugin's failure to properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. This can be exploited by anyone permitted to view the forms statistics chart, which by default includes administrators, although permissions can be configured otherwise via the plugin settings.

Recommendations For versions prior to 7.9.7, update to version 7.9.7 or later to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2022-3142

Affected Products

Nex-Forms

References · 8

• 🔥 https://exploit-db.com/exploits/51042 · Exploit
• 🔥 https://medium.com/@elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5 · Exploit
• 🔥 https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328 · Exploit
• https://osv.dev/vulnerability/CVE-2022-3142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3142 · Security Note
• https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5 · Note
• http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html · Note
• https://t.me/cibsecurity/50038 · Telegram Post