Lucene search

WPScanCVE-2022-4445

HistoryFeb 13, 2023 - 3:15 p.m.

CVE-2022-4445

2023-02-1315:15:16

WPScan

web.nvd.nist.gov

cve-2022-4445

fl3r feelbox

wordpress plugin

sql injection

nvd

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

58.2%

JSON

The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Affected configurations

Nvd

Vulners

Node

fl3r_feelbox_projectfl3r_feelboxRange≤8.1wordpress

VendorProductVersionCPE
fl3r_feelbox_projectfl3r_feelbox*cpe:2.3:a:fl3r_feelbox_project:fl3r_feelbox:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
fl3r_feelbox_project	fl3r_feelbox	*	cpe:2.3:a:fl3r_feelbox_project:fl3r_feelbox::::::wordpress::*

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "FL3R FeelBox",
    "versions": [
      {
        "status": "affected",
        "versionType": "custom",
        "version": "0",
        "lessThanOrEqual": "8.1"
      }
    ],
    "defaultStatus": "affected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]

References

wpscan.com/vulnerability/9bb6fde0-1347-496b-be03-3512e6b7e8f8

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.002

Percentile

58.2%

JSON

Related for CVE-2022-4445