ByteOS Network

CVE Vulnerability Details :

CVE-2022-25148

PUBLISHED

More Info Official Page

Assigner-Wordfence

Assigner Org ID-b15e7b5b-3da4-40ae-a43c-f7aa60e62599

Published At-24 Feb, 2022 | 00:00

Updated At-03 Aug, 2024 | 04:29

▼CVE Numbering Authority (CNA)

WP Statistics <= 13.1.5 Unauthenticated Blind SQL Injection via current_page_id

The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.

Affected Products

Vendor

WP Statistics

Product

WP Statistics

Versions

Affected

From 13.1.5 through 13.1.5 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-89	CWE-89 SQL Injection

Metrics

Version	Base score	Base severity	Vector
3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Solutions

Update to version 13.1.6 or newer.

Credits

Muhammad Zeeshan (Xib3rR4dAr)

References

Hyperlink	Resource
https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042	N/A
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25148	N/A
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=	N/A
http://packetstormsecurity.com/files/174482/WordPress-WP-Statistics-13.1.5-SQL-Injection.html	N/A

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042	x_transferred
https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25148	x_transferred
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=	x_transferred
http://packetstormsecurity.com/files/174482/WordPress-WP-Statistics-13.1.5-SQL-Injection.html	x_transferred

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References