106 lines
4.1 KiB
JSON
106 lines
4.1 KiB
JSON
{
|
||
"dataType": "CVE_RECORD",
|
||
"dataVersion": "5.1",
|
||
"cveMetadata": {
|
||
"state": "PUBLISHED",
|
||
"cveId": "CVE-2022-3141",
|
||
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
|
||
"assignerShortName": "WPScan",
|
||
"dateUpdated": "2024-08-03T01:00:10.566Z",
|
||
"dateReserved": "2022-09-06T00:00:00.000Z",
|
||
"datePublished": "2022-09-19T00:00:00.000Z"
|
||
},
|
||
"containers": {
|
||
"cna": {
|
||
"title": "Translatepress Multilinugal < 2.3.3 - Admin+ SQLi",
|
||
"providerMetadata": {
|
||
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
|
||
"shortName": "WPScan",
|
||
"dateUpdated": "2023-03-27T00:00:00.000Z"
|
||
},
|
||
"descriptions": [
|
||
{
|
||
"lang": "en",
|
||
"value": "The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected."
|
||
}
|
||
],
|
||
"affected": [
|
||
{
|
||
"vendor": "Unknown",
|
||
"product": "Translate Multilingual sites – TranslatePress",
|
||
"versions": [
|
||
{
|
||
"version": "2.3.3",
|
||
"status": "affected",
|
||
"lessThan": "2.3.3",
|
||
"versionType": "custom"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"references": [
|
||
{
|
||
"url": "https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-translatepress-multilingual-wordpress-plugin-effc08eda514"
|
||
},
|
||
{
|
||
"url": "https://wpscan.com/vulnerability/1fa355d1-cca8-4b27-9d21-0b420a2e1bf3"
|
||
},
|
||
{
|
||
"url": "http://packetstormsecurity.com/files/171479/WordPress-Translatepress-Multilingual-SQL-Injection.html"
|
||
}
|
||
],
|
||
"credits": [
|
||
{
|
||
"lang": "en",
|
||
"value": "Elias Hohl"
|
||
}
|
||
],
|
||
"problemTypes": [
|
||
{
|
||
"descriptions": [
|
||
{
|
||
"type": "CWE",
|
||
"description": "CWE-89 SQL Injection",
|
||
"cweId": "CWE-89",
|
||
"lang": "en"
|
||
}
|
||
]
|
||
}
|
||
],
|
||
"x_generator": "WPScan CVE Generator",
|
||
"source": {
|
||
"discovery": "EXTERNAL"
|
||
}
|
||
},
|
||
"adp": [
|
||
{
|
||
"providerMetadata": {
|
||
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
|
||
"shortName": "CVE",
|
||
"dateUpdated": "2024-08-03T01:00:10.566Z"
|
||
},
|
||
"title": "CVE Program Container",
|
||
"references": [
|
||
{
|
||
"url": "https://medium.com/%40elias.hohl/authenticated-sql-injection-vulnerability-in-translatepress-multilingual-wordpress-plugin-effc08eda514",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "https://wpscan.com/vulnerability/1fa355d1-cca8-4b27-9d21-0b420a2e1bf3",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
},
|
||
{
|
||
"url": "http://packetstormsecurity.com/files/171479/WordPress-Translatepress-Multilingual-SQL-Injection.html",
|
||
"tags": [
|
||
"x_transferred"
|
||
]
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
} |