CVE-2022-4153: Contest Gallery < 19.1.5.1 - Author+ SQL Injection
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the upload[] POST parameter before concatenating it to an SQL query in get-data-create-upload-v10.php. This may allow malicious users with at least author privilege to leak sensitive information from the site's database.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-4153?
CVE-2022-4153 is a vulnerability in the Contest Gallery WordPress plugin and Contest Gallery Pro WordPress plugin before version 19.1.5.1.
How does CVE-2022-4153 affect the Contest Gallery WordPress plugin?
CVE-2022-4153 allows malicious users with at least author privilege to leak sensitive information due to improper handling of the upload[] POST parameter.
What is the severity of CVE-2022-4153?
The severity of CVE-2022-4153 is medium with a CVSS score of 6.5.
How can I fix CVE-2022-4153?
To fix CVE-2022-4153, you should update the Contest Gallery WordPress plugin and Contest Gallery Pro WordPress plugin to version 19.1.5.1 or later.
Where can I find more information about CVE-2022-4153?
You can find more information about CVE-2022-4153 at the following references: [Link 1](https://bulletin.iese.de/post/contest-gallery_19-1-4-1_7) and [Link 2](https://wpscan.com/vulnerability/35b0126d-9293-4e64-a00f-0903303f960a).