CVE-2022-1768 RSVPMaker <= 9.3.2 - Unauthenticated SQL Injection

What is CVE-2022-1768?

CVE-2022-1768 is a critical SQL injection vulnerability in davidfcarr RSVPMaker, published on 13 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2. Please note that this is separate from CVE-2022-1453 & CVE-2022-1505.

Weakness: CWE-89

Which versions are affected by CVE-2022-1768?

It affects 1 product.

Products include Carrcommunications Rsvpmaker.

How do I fix CVE-2022-1768?

No fix has been published for CVE-2022-1768 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-1768 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-1768 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in davidfcarr RSVPMaker

• CVE-2024-50531 WordPress RSVPMaker for Toastmasters plugin <= 6.2.4 - Arbitrary File Upload vulnerability Critical 10.0
• CVE-2023-25054 WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to Remote Code Execution (RCE) Critical 10.0
• CVE-2022-1453 RSVPMaker <= 9.2.5 - Unauthenticated SQL Injection Critical 9.8
• CVE-2022-1505 RSVPMaker <= 9.2.6 - Unauthenticated SQL Injection Critical 9.8
• CVE-2018-21004 SQL injection in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-q33g-8g5w-2m7c.