by Kastro
Paper/Archive/CVE-2022-4099

CVE-2022-4099

Unknown Joy Of Text Lite — Joy Of Text Lite < 2.3.1 - Unauthenticated SQLi

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 64.2.642 × 2012.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unauthenticated users, leading to unauthenticated SQL injection

Affected

ProductAffectedFixed inSource
Joy Of Text Lite< 2.3.12.3.1CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/a282dd39-926d-406b-b8f5-e4c6e0c2c028