CVE-2022-0781

published 2022-05-23

CVE-2022-0781: The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to…

Priority P1 82 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW EXPLOIT VulnCheck KEV

The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to unauthenticated users), leading to an SQL injection

Affected

1 ranges

Vendor	Product	Version range	Fixed in
nirweb	nirweb_support	< 2.8.2	2.8.2

Detection & IOCs extracted from sources · hover to see the quote

url /wp-admin/admin-ajax.php↗

command action=answerd_ticket&id_form=1 UNION ALL SELECT NULL,NULL,md5({{num}}),NULL,NULL,NULL,NULL,NULL-- -↗

• → Monitor POST requests to /wp-admin/admin-ajax.php with the parameter 'action=answerd_ticket' — this is the unauthenticated AJAX action vulnerable to SQL injection in Nirweb Support <2.8.2. ↗
• → Look for UNION-based SQL injection payloads in the 'id_form' POST parameter on admin-ajax.php requests, particularly patterns like 'UNION ALL SELECT NULL' with comment terminators '-- -'. ↗
• → The exploit is available to unauthenticated users (no authentication/nonce required), so detections should not filter by authentication state. ↗
• → Content-Type header is application/x-www-form-urlencoded; alert on this combination with the answerd_ticket action and SQL metacharacters in id_form. ↗

• · The SQL injection payload uses an 8-column UNION SELECT (NULL×8), meaning the vulnerable query returns exactly 8 columns. Adjust column counts if probing other injection points. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.5 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P

vulncheck 9.8 CRITICAL

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89