CVE-2022-0661 Ad Injection <= 1.2.0.19 - Admin+ Stored Cross-Site Scripting & RCE
Admins can inject PHP code for remote code execution and HTML/JS for stored XSS in the Ad Injection WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-0661?
CVE-2022-0661 is a high-severity code injection vulnerability in Unknown Ad Injection, published on 18 Apr 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.
Weakness: CWE-94
Which versions are affected by CVE-2022-0661?
It affects 1 product.
Products include Ad Injection Project Ad Injection.
How do I fix CVE-2022-0661?
No fix has been published for CVE-2022-0661 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2022-0661 being exploited?
There is no known exploitation of CVE-2022-0661 in the wild and no public exploit code.
Sources
Also known as GHSA-g5jf-j433-qxmq.