Lucene search
PRIOn knowledge basePRION:CVE-2022-4372HistoryJan 02, 2023 - 10:15 p.m.
Sql injection
2023-01-0222:15:00
PRIOn knowledge base
www.prio-n.com
5
sql injection
wordpress
web invoice
high privilege
admin
configuration
subscriber
0.001 Low
EPSS
Percentile
43.0%
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
| CPE | Name | Operator | Version |
|---|---|---|---|
| web_invoice | le | 2.1.3 |
Related
cve
cve
CVE-2022-4372
2023-01-02 22:15:17
cvelist
cvelist
CVE-2022-4372 Web Invoice <= 2.1.3 - Authenticated SQLi
2023-01-02 21:49:39
wpvulndb
wpvulndb
Web Invoice <= 2.1.3 - Authenticated SQLi
2022-12-12 00:00:00
nvd
nvd
CVE-2022-4372
2023-01-02 22:15:17
wpexploit
wpexploit
Web Invoice <= 2.1.3 - Authenticated SQLi
2022-12-12 00:00:00