Vulnerability · Published Mar 14, 2022 · Assigned by WPScan

CVE-2022-0169Photo Gallery by 10Web < 1.6.0 - Unauthenticated SQL Injection

Critical 9.8

In plain English

A critical-severity SQL injection in Photo Gallery by 10Web – Mobile-Friendly Image Gallery from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 74.6% (higher than 99.5% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code.

Severity (CVSS NVD)9.8Critical

Exploit odds (30 days)74.6%top 0.5% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack tooling3Metasploit, Nuclei, Public PoC

Official description

The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection

Affected products (as reported)

Vendor	Product	Versions
Unknown	Photo Gallery by 10Web – Mobile-Friendly Image Gallery	1.6.0 – before 1.6.0

Weakness: CWE-89

References

https://wpscan.com/vulnerability/0b4d870f-eab8-4544-91f8-9c5f0538709c x_refsource_MISC
https://plugins.trac.wordpress.org/changeset/2672822/photo-gallery#file9 x_refsource_CONFIRM