CVE-2022-2840

The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

10.50% chance of exploitation in the next 30 days, 95th percentile

Published

2022-09-19

Updated

2024-08-03

Proof-of-concept exploits (2)

• http://packetstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-I…
• https://wpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53c

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/51024

References

• CVE Record
• NVD entry

Related

• CVE-2022-2839
• CVE-2022-2841
• CVE-2022-28387
• CVE-2022-28410
• CVE-2022-28386
• CVE-2022-28411