CVE-2022-33965

published 2022-07-25

CVE-2022-33965: Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.

Priority P2 65 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
codepress	visitor_statistics	< 5.8	5.8
osamaesh	wp_visitor_statistics	<= 5.7	—

Detection & IOCs extracted from sources · hover to see the quote

url /?wmcAction=wmcTrack&url=test&uid=0&pid=0&visitorId=1331'+and+sleep(7)+or+'↗

other wmcAction=wmcTrack↗

path /wp-content/plugins/wp-stats-manager↗

• → Time-based blind SQLi: inject sleep(7) via the `visitorId` GET parameter of the `wmcTrack` action; flag if HTTP response duration >= 7 seconds with HTTP 200. ↗
• → Match response body for the literal injected payload string to confirm exploitation: regex `^1331' and sleep\(7\) or '$` ↗
• → Shodan fingerprint for exposed instances: search `http.html:"wp-stats-manager"` ↗
• → FOFA fingerprint for exposed instances: search `body="wp-stats-manager"` ↗
• → The vulnerability is unauthenticated (no credentials required); any HTTP client can trigger it via a crafted GET request to the WordPress front-end. ↗

• · The time-based detection threshold is set to 7 seconds sleep; adjust WAF/IDS timeout baselines accordingly to avoid false negatives on slow hosts. ↗
• · Affected versions are <= 5.7; upgrade to version 5.8 or later to remediate. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-89