Lucene search

CVE-2022-1578

🗓️ 21 Nov 2022 11:19:15Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 7 Media mentions👁 41 Views🌐 WEB

The My wpdb WordPress plugin has a CSRF vulnerabilit

Reporter	Title	Published	Views	Family All 7
Prion	Cross site request forgery (csrf)	21 Nov 202211:15	–	prion
Patchstack	WordPress My wpdb plugin <= 2.4 - Arbitrary SQL Query via Cross-Site Request Forgery (CSRF) vulnerability	29 Oct 202200:00	–	patchstack
CNVD	WordPress My wpdb plugin cross-site request forgery vulnerability	23 Nov 202200:00	–	cnvd
wpexploit	My wpdb < 2.5 - Arbitrary SQL Query via CSRF	28 Oct 202200:00	–	wpexploit
WPVulnDB	My wpdb < 2.5 - Arbitrary SQL Query via CSRF	28 Oct 202200:00	–	wpvulndb
Cvelist	CVE-2022-1578 My wpdb < 2.5 - Arbitrary SQL Query via CSRF	21 Nov 202200:00	–	cvelist
NVD	CVE-2022-1578	21 Nov 202211:15	–	nvd

Nvd

Vulners

Node

my_wpdb_project my_wpdbRange<2.5wordpress

[
  {
    "vendor": "Unknown",
    "product": "My wpdb",
    "collectionURL": "https://wordpress.org/plugins",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThan": "2.5"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/c280da92-4ac2-43ea-93a2-6c583b79b98b

Parameter	Position	Path	Description	CWE
umeta_id	request body	/wp-admin/?page=mywpdb_page&table=wp_usermeta&where%5Bumeta_id%5D=1	CSRF vulnerability allowing execution of arbitrary SQL queries by a logged in admin.	CWE-352, CWE-89
user_id	request body	/wp-admin/?page=mywpdb_page&table=wp_usermeta&where%5Bumeta_id%5D=1	CSRF vulnerability allowing execution of arbitrary SQL queries by a logged in admin.	CWE-352, CWE-89
meta_key	request body	/wp-admin/?page=mywpdb_page&table=wp_usermeta&where%5Bumeta_id%5D=1	CSRF vulnerability allowing execution of arbitrary SQL queries by a logged in admin.	CWE-352, CWE-89
meta_value	request body	/wp-admin/?page=mywpdb_page&table=wp_usermeta&where%5Bumeta_id%5D=1	CSRF vulnerability allowing execution of arbitrary SQL queries by a logged in admin.	CWE-352, CWE-89
mywpdbUpdateTrigger	request body	/wp-admin/?page=mywpdb_page&table=wp_usermeta&where%5Bumeta_id%5D=1	CSRF vulnerability allowing execution of arbitrary SQL queries by a logged in admin.	CWE-352, CWE-89

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

21 Nov 2022 11:15Current

8.8High risk

Vulners AI Score8.8

CVSS38.8

EPSS0.00258