Vulnerability · Published Jan 2, 2023 · Assigned by WPScan
CVE-2022-4371Web Invoice <= 2.1.3 - Authenticated SQLi
High 7.2
In plain English
A high-severity security flaw in Web Invoice from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)1.1%top 34.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Web Invoice | 0 – through 2.1.3 |
References
- https://wpscan.com/vulnerability/45f43359-98c2-4447-b51b-2d466bad8261 exploit, vdb-entry, technical-description
- https://bulletin.iese.de/post/web-invoice_2-1-3_1