CVE-2022-0817 BadgeOS <= 3.7.0 - Unauthenticated SQLi

What is CVE-2022-0817?

CVE-2022-0817 is a critical SQL injection vulnerability in Unknown BadgeOS, published on 9 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users

Weakness: CWE-89

Which versions are affected by CVE-2022-0817?

It affects 1 product.

Products include Badgeos Badgeos.

How do I fix CVE-2022-0817?

No fix has been published for CVE-2022-0817 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-0817 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-0817 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Unknown BadgeOS

• CVE-2023-2173 BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletion Medium 6.5
• CVE-2022-41987 WordPress BadgeOS Plugin <= 3.7.1.6 is vulnerable to Cross Site Request Forgery (CSRF) Medium 6.3
• CVE-2023-2171 BadgeOS <= 3.7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Medium 5.4
• CVE-2023-2172 BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Title Overwrite Medium 4.3
• CVE-2023-2174 BadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entries Medium 4.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xx94-r2jp-2426.