CVE-2022-2840 Zephyr Project Manager < 3.2.5 - Multiple Unauthenticated SQLi

What is CVE-2022-2840?

CVE-2022-2840 is a critical SQL injection vulnerability in Unknown Zephyr Project Manager, published on 19 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections

Weakness: CWE-89

Which versions are affected by CVE-2022-2840?

It affects 1 product.

Products include Zephyr-One Zephyr Project Manager.

How do I fix CVE-2022-2840?

No fix has been published for CVE-2022-2840 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-2840 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2840 exists.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in Unknown Zephyr Project Manager

• CVE-2024-37484 WordPress Zephyr Project Manager plugin <= 3.3.97 - Privilege Escalation vulnerability High 8.8
• CVE-2024-7624 Zephyr Project Manager <= 3.3.101 - Authenticated (Subscriber+) Limited Privilege Escalation High 8.1
• CVE-2024-38761 WordPress Zephyr Project Manager plugin <= 3.3.99 - Sensitive Data Exposure via Export File vulnerability High 7.5
• CVE-2025-32526 WordPress Zephyr Project Manager plugin <= 3.3.101 - Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2024-7356 Zephyr Project Manager <= 3.3.100 - Authenticated (Subscriber+) Stored Cross-Site Scripting via filename Parameter Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-v5j7-5w29-28r9.