← Volver a CVEs
CVE-2022-3142
HIGH8.8
Descripcion
The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
Detalles CVE
Puntuacion CVSS v3.18.8
SeveridadHIGH
Vector CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vector de ataqueNETWORK
ComplejidadLOW
Privilegios requeridosLOW
Interaccion usuarioNONE
Publicado9/19/2022
Ultima modificacion11/21/2024
Fuentenvd
Avistamientos honeypot0
Productos afectados
basixonline:nex-forms
Debilidades (CWE)
CWE-89
Referencias
http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html(contact@wpscan.com)
https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5(contact@wpscan.com)
https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328(contact@wpscan.com)
http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html(af854a3a-2127-422b-91ae-364da2661108)
https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5(af854a3a-2127-422b-91ae-364da2661108)
https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328(af854a3a-2127-422b-91ae-364da2661108)
Correlaciones IOC
Sin correlaciones registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.