The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
References
| Link | Resource |
|---|---|
| https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 | Exploit Third Party Advisory |
| https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= | Patch Third Party Advisory |
| https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0651 | Third Party Advisory |
| https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 | Exploit Third Party Advisory |
| https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= | Patch Third Party Advisory |
| https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0651 | Third Party Advisory |
Configurations
History
21 Nov 2024, 06:39
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 - Exploit, Third Party Advisory | |
| References | () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= - Patch, Third Party Advisory | |
| References | () https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0651 - Third Party Advisory | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 9.8 |
03 Mar 2022, 03:02
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:veronalabs:wp_statistics:*:*:*:*:*:wordpress:*:* | |
| References | (MISC) https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0651 - Third Party Advisory | |
| References | (MISC) https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail= - Patch, Third Party Advisory | |
| References | (MISC) https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 - Exploit, Third Party Advisory | |
| CWE | CWE-89 | |
| CVSS |
v2 : v3 : |
v2 : 5.0
v3 : 7.5 |
24 Feb 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2022-02-24 19:15
Updated : 2024-11-21 06:39
NVD link : CVE-2022-0651
Mitre link : CVE-2022-0651
CVE.ORG link : CVE-2022-0651
JSON object : View
Products Affected
veronalabs
- wp_statistics
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')