Lucene search
HistoryDec 26, 2022 - 1:15 p.m.
CVE-2022-4117
iws plugin
wordpress
unauthenticated sql injection
ajax action
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.061
Percentile
93.7%
The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.
Affected configurations
Node
iws-geo-form-fields_projectiws-geo-form-fieldsRange≤1.0wordpress
| Vendor | Product | Version | CPE |
|---|---|---|---|
| iws-geo-form-fields_project | iws-geo-form-fields | * | cpe:2.3:a:iws-geo-form-fields_project:iws-geo-form-fields:*:*:*:*:*:wordpress:*:* |
Related
prion
prion
Sql injection
2022-12-26 13:15:00
cvelist
cvelist
CVE-2022-4117 IWS - Geo Form Fields <= 1.0 - Unauthenticated SQLi
2022-12-26 12:28:08
cve
cve
CVE-2022-4117
2022-12-26 13:15:12
nuclei
nuclei
WordPress IWS Geo Form Fields <=1.0 - SQL Injection
2023-03-18 22:07:09
CVSS3
9.8
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
0.061
Percentile
93.7%
Related for NVD:CVE-2022-4117