PT-2022-7047 · 10Web · The Photo Gallery

Krzysztof Zając · Published 2022-02-04 · Updated 2022-03-21 · CVE-2022-0169

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions The Photo Gallery by 10Web WordPress plugin versions prior to 1.6.0

Description The issue is related to a lack of validation and escaping of the bwg tag id bwg thumbnails 0 parameter in SQL statements via the /wp-admin/admin-ajax.php endpoint, specifically through the bwg frontend data AJAX action. This can lead to SQL injection, allowing a remote attacker to execute arbitrary SQL code. The vulnerability can be exploited by both unauthenticated and authenticated users.

Recommendations For versions prior to 1.6.0, update to version 1.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the bwg frontend data AJAX action to minimize the risk of exploitation. Avoid using the bwg tag id bwg thumbnails 0 parameter in the affected AJAX endpoint until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2023-07223

CVE-2022-0169

Affected Products

The Photo Gallery

References · 6

• 🔥 https://wpscan.com/vulnerability/0b4d870f-eab8-4544-91f8-9c5f0538709c · Exploit
• https://osv.dev/vulnerability/CVE-2022-0169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0169 · Security Note
• https://plugins.trac.wordpress.org/changeset/2672822/photo-gallery#file9 · Patch
• https://bdu.fstec.ru/vul/2023-07223 · Security Note
• https://ru.wordpress.org/plugins/photo-gallery · Note