CVE-2022-0747: Infographic Maker - iList < 4.3.8 - Unauthenticated SQL Injection
The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the postid parameter before using it in a SQL statement via the qcldupvoteaction AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-0747?
CVE-2022-0747 is a vulnerability in the Infographic Maker WordPress plugin that allows unauthenticated SQL injection.
How does CVE-2022-0747 affect the Infographic Maker plugin?
CVE-2022-0747 affects the Infographic Maker WordPress plugin version up to 4.3.8.
What is the severity of CVE-2022-0747?
CVE-2022-0747 has a severity rating of 9.8 (critical).
How can I fix the CVE-2022-0747 vulnerability?
To fix the CVE-2022-0747 vulnerability, update the Infographic Maker WordPress plugin to version 4.3.8 or later.
What is SQL injection?
SQL injection is a technique where an attacker injects malicious SQL statements into an application's database query, allowing them to manipulate the database and potentially gain unauthorized access to data.