CVE-2022-0773

Documentor <= 1.5.3 - Unauthenticated SQLi

The Documentor WordPress plugin through 1.5.3 fails to sanitize and escape user input before it is being interpolated in an SQL statement and then executed, leading to an SQL Injection exploitable by unauthenticated users.

Affected

Documentor – Create Product Documentation

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

43.26% chance of exploitation in the next 30 days, 99th percentile

Nuclei

critical · CWE-89

Published

2022-05-02

Updated

2024-08-02

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/55b89de0-30ed-4f98-935e-51f069faf6fc

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0773.yaml

References

• CVE Record
• NVD entry