Vulnerability · Published May 9, 2022 · Assigned by WPScan
CVE-2022-0817BadgeOS <= 3.7.0 - Unauthenticated SQLi
Critical 9.8
In plain English
A critical-severity SQL injection in BadgeOS from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 11.6% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)11.6%top 3.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei
Official description
The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users
Affected products (as reported)
Weakness: CWE-89