CVE-2022-0887 Easy Social Icons < 3.1.4 - Admin+ SQL Injection
An authenticated administrator can exploit a SQL injection vulnerability in the Easy Social Icons plugin to read or modify database contents.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-0887?
CVE-2022-0887 is a high-severity SQL injection vulnerability in Unknown Easy Social Icons, published on 4 Apr 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statement, leading to a SQL injection vulnerability.
Weakness: CWE-89
Which versions are affected by CVE-2022-0887?
It affects 1 product.
Products include Cybernetikz Easy Social Icons.
How do I fix CVE-2022-0887?
No fix has been published for CVE-2022-0887 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-0887 being exploited?
There is no known exploitation of CVE-2022-0887 in the wild and no public exploit code.
Other vulnerabilities in Unknown Easy Social Icons
- CVE-2015-2084 Cross-site request forgery in n/a
- CVE-2023-48336 WordPress Easy Social Icons Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)
- CVE-2021-39322 Easy Social Icons <= 3.0.8 - Reflected Cross-Site Scripting
- CVE-2022-0840 Easy Social Icons < 3.2.1 - Admin+ Stored Cross-Site Scripting in add icon
Sources
Also known as GHSA-fqw9-gq3m-ggrh.