critical9.8Public exploit code
CVE-2022-2840
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Wordpress Plugin Zephyr Project Manager 3.2.42 - Multiple SQLi2022-10-06 · webapps · php · Verified
Impact
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Zephyr-One | Zephyr Project Manager | before 3.2.5 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-Injection.html
- https://wpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53c
- http://packetstormsecurity.com/files/168652/WordPress-Zephyr-Project-Manager-3.2.42-SQL-Injection.html
- https://wpscan.com/vulnerability/13d8be88-c3b7-4d6e-9792-c98b801ba53c