Translatepress Multilinugal < 2.3.3 – Admin+ SQLi | CVE 2022-3141 | Plugin Vulnerabilities

Description

The plugin is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.

Proof of Concept

To exploit the vulnerability, someone must send a specifically crafted request adding a new language containing specific special characters, and then open another page and measure the response time to retrieve data. This can be automated via sqlmap.

Affects Plugins

translatepress-multilingual

Fixed in 2.3.3

References

CVE

URL

https://github.com/ehtec/translatepress-exploit

URL

https://medium.com/@elias.hohl/authenticated-sql-injection-vulnerability-in-translatepress-multilingual-wordpress-plugin-effc08eda514

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Elias Hohl

Submitter

Elias Hohl

Submitter website

https://ehtec.co

Submitter twitter

Verified

Yes

WPVDB ID

1fa355d1-cca8-4b27-9d21-0b420a2e1bf3

Timeline

Publicly Published

2022-07-23 (about 3 years ago)

Added

2022-09-06 (about 3 years ago)

Last Updated

2022-09-06 (about 3 years ago)

Other

Published

Title

Published

2016-10-06

Title

Zotpress < 6.1.3 - SQL Injection

Published

2024-10-18

Title

SW Contact Form <= 1.0 - Authenticated (Subscriber+) SQL Injection

Published

2019-07-16

Title

Web Librarian < 3.5.5 - SQL Injection

Published

2014-08-01

Title

WP Bannerize <= 2.8.6 - SQL Injection

Published

2023-12-04

Title

Couponis Demo < 2.2 - Unauthenticated SQL Injection