CVE-2022-2840

Published Sep 19, 2022

Last updated 2 months ago

CVSS critical 9.8

Overview

Description: The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
Source: contact@wpscan.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

nvd@nist.gov: CWE-89
contact@wpscan.com: CWE-89

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:zephyr-one:zephyr_project_manager:*:*:*:*:*:wordpress:*:*",
            "vulnerable": true,
            "matchCriteriaId": "989B933B-8206-43E2-B089-E706F3800F62",
            "versionEndExcluding": "3.2.5"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

References