CVE-2022-25148
published 2022-02-24CVE-2022-25148: The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in…
PriorityP276high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EXPLOIT
EPSS
81.36%
99.6th percentile
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| veronalabs | wp_statistics | <= 13.1.5 | — |
| wp_statistics | wp_statistics | 13.1.5 – 13.1.5 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Unauthenticated time-based SQL injection via the current_page_id parameter in WP Statistics plugin versions up to and including 13.1.5; no authentication required to exploit. ↗
- →Successful exploitation of the hit-recording endpoint returns HTTP 200 with Content-Type application/json and body containing 'Visitor Hit was recorded successfully'; use this as a positive response indicator when probing. ↗
- →A valid _wpnonce value must be extracted from the page before injecting; monitor for automated nonce-harvesting requests followed immediately by POST requests containing time-delay SQL payloads to the WP Statistics hit endpoint. ↗
- ·Vulnerability affects WP Statistics plugin versions up to and including 13.1.5 only; verify installed version before applying detections. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
exploitdb·2023-09-04·CVSS 9.8
CVE-2022-25148 [CRITICAL] WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
---
# Exploit Title: WP Statistics Plugin = 5.0:
print("\n!!! Target is vulnerable !!!")
print(f'\nTime taken: {resp.elapsed.total_seconds()}')
else:
print('Target is not vulnerable')
if __name__ == "__main__":
main()
Nuclei
WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
nuclei·CVSS 7.5
CVE-2022-25148 [HIGH] WordPress Plugin WP Statistics <= 13.1.5 - SQL Injection
WordPress Plugin WP Statistics =6
- status_code == 200
- contains(header, "application/json")
- contains(body, 'Visitor Hit was recorded successfully')
condition: and
extractors:
- type: regex
name: nonce
group: 1
regex:
- '_wpnonce=([0-9a-zA-Z]+)'
internal: true
# digest: 4a0a004730450220100723ba63961c2be7fa80f29a1b3f0cf4b082833719523917ec2fdf0724714e022100805324b9c9254c113b30a489b4cff61ed3602f90d8bea3c4c2c8095e4c89e6fa:922c64590222798bb761d5b6d8e72950
No writeups or analysis indexed.
http://packetstormsecurity.com/files/174482/WordPress-WP-Statistics-13.1.5-SQL-Injection.htmlhttps://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25148http://packetstormsecurity.com/files/174482/WordPress-WP-Statistics-13.1.5-SQL-Injection.htmlhttps://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=https://www.wordfence.com/vulnerability-advisories/#CVE-2022-25148
2022-02-24
Published