by Kastro
Paper/Archive/CVE-2022-0836

CVE-2022-0836

Unknown SEMA API — SEMA API < 4.02 - Unauthenticated SQLi

EPSS 2%CVSS 9.8
critical.is priorityof 100
45
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 78.3.783 × 2015.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The SEMA API WordPress plugin before 4.02 does not properly sanitise and escape some parameters before using them in SQL statements via an AJAX action, leading to SQL Injections exploitable by unauthenticated users

Affected

ProductAffectedFixed inSource
SEMA API4.02 – < 4.024.02CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refwpscan.com/vulnerability/2a226ae8-7d9c-4f47-90af-8a399a08f03f