Vulnerability · Published May 2, 2022 · Assigned by WPScan
CVE-2022-1281Photo Gallery < 1.6.3 - Unauthenticated SQL Injection
Critical 9.8
In plain English
A critical-severity SQL injection in Photo Gallery by 10Web – Mobile-Friendly Image Gallery from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 43.4% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)43.4%top 1.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $_POST['filter_tag'] parameter, which is appended to an SQL query, making SQL Injection attacks possible.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 1.6.3 – before 1.6.3* |
Weakness: CWE-89
References
- https://wpscan.com/vulnerability/2b4866f2-f511-41c6-8135-cf1e0263d8de x_refsource_MISC
- https://plugins.trac.wordpress.org/changeset/2706797/photo-gallery/trunk/frontend/models/BWGModelGalleryBox.php?old=2587758&old_path=photo-gallery%2Ftrunk%2Ffrontend%2Fmodels%2FBWGModelGalleryBox.php x_refsource_CONFIRM