← Retour aux CVEs

CVE-2022-3142

HIGH

8.8

Description

The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.

Details CVE

Score CVSS v3.18.8

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie9/19/2022

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

basixonline:nex-forms

Faiblesses (CWE)

CWE-89

References

http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html(contact@wpscan.com)

https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5(contact@wpscan.com)

https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328(contact@wpscan.com)

http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html(af854a3a-2127-422b-91ae-364da2661108)

https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5(af854a3a-2127-422b-91ae-364da2661108)

https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.