CVE-2022-4158: Contest Gallery < 19.1.5 - Unauthenticated SQL Injection
First published: Mon Dec 26 2022(Updated: )
The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before concatenating it to an SQL query in users-registry-check-registering-and-login.php. This may allow malicious visitors to leak sensitive information from the site's database.
Credit: contact@wpscan.com contact@wpscan.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Contest-gallery Contest Gallery | <19.1.5.1 | |
| Contest-gallery Contest Gallery | <19.1.5.1 | |
| <19.1.5.1 | ||
| <19.1.5.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the CVE ID for this vulnerability?
The CVE ID for this vulnerability is CVE-2022-4158.
What is the affected software?
The affected software is Contest Gallery WordPress plugin before 19.1.5.1 and Contest Gallery Pro WordPress plugin before 19.1.5.1.
What is the severity of CVE-2022-4158?
The severity of CVE-2022-4158 is high with a value of 7.5.
How can this vulnerability be exploited?
This vulnerability can be exploited by malicious visitors leaking sensitive information.
Is there a fix available for this vulnerability?
Yes, the fix for this vulnerability is to update to Contest Gallery WordPress plugin version 19.1.5.1 or Contest Gallery Pro WordPress plugin version 19.1.5.1.
- collector/nvd-index
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/author
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/contest-gallery
- canonical/contest-gallery contest gallery