Vulnerability · Published Dec 26, 2022 · Assigned by WPScan

CVE-2022-4117IWS - Geo Form Fields <= 1.0 - Unauthenticated SQLi

Critical 9.8

In plain English

A critical-severity security flaw in IWS from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 5.3% (higher than 93% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)5.3%top 7.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Nuclei

Official description

The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection.

Affected products (as reported)

Vendor	Product	Versions
Unknown	IWS	0 – through 1.0

References

https://wpscan.com/vulnerability/1fac3eb4-13c0-442d-b27c-7b7736208193 exploit, vdb-entry, technical-description