CVE-2022-0410 WP Visitor Statistics (Real Time Traffic) < 5.6 - Subscriber+ SQL Injection

What is CVE-2022-0410?

CVE-2022-0410 is a high-severity SQL injection vulnerability in Unknown WP Visitor Statistics (Real Time Traffic), published on 7 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection

Weakness: CWE-89

Which versions are affected by CVE-2022-0410?

It affects 1 product.

Products include Codepress Visitor Statistics.

How do I fix CVE-2022-0410?

No fix has been published for CVE-2022-0410 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-0410 being exploited?

There is no known exploitation of CVE-2022-0410 in the wild and no public exploit code.

Other vulnerabilities in Unknown WP Visitor Statistics (Real Time Traffic)

• CVE-2023-0600 WP Visitor Statistics (Real Time Traffic) < 6.9 - Unauthenticated SQLi Critical 9.8
• CVE-2022-33965 WordPress WP Visitor Statistics plugin <= 5.7 - Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities Critical 9.3
• CVE-2021-24750 WP Visitor Statistics (Real Time Traffic) < 4.8 - Subscriber+ SQL Injection High 8.8
• CVE-2022-4656 WP Visitor Statistics (Real Time Traffic) < 6.5 - Contributor+ Stored XSS via Shortcode Medium 5.4
• CVE-2021-25042 WP Visitor Statistics (Real Time Traffic) < 5.5 - Arbitrary IP Address Exclusion to Stored XSS Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-hgrv-3cp5-97qg.