CVE-2022-3243 Import all XML, CSV & TXT into WordPress < 6.5.8 - Admin+ SQLi
An admin-level SQL injection vulnerability in the Import all XML, CSV & TXT WordPress plugin allows attackers to manipulate database queries via imported data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3243?
CVE-2022-3243 is a high-severity SQL injection vulnerability in Unknown Import all XML, CSV & TXT into WordPress, published on 17 Oct 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin
Weakness: CWE-89
Which versions are affected by CVE-2022-3243?
It affects 1 product.
Products include Smackcoders Import All Pages\, Post Types\, Products\, Orders\, and Users as Xml \& Csv.
How do I fix CVE-2022-3243?
No fix has been published for CVE-2022-3243 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-3243 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3243 exists.
Other vulnerabilities in Unknown Import all XML, CSV & TXT into WordPress
- CVE-2018-20967 Cross-site request forgery in n/a
- CVE-2022-1977 WP Ultimate CSV Importer < 6.5.3 - Admin+ Blind SSRF
- CVE-2015-9306 Cross-site scripting in n/a
- CVE-2022-0360 WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting
- CVE-2015-10125 WP Ultimate CSV Importer Plugin cross-site request forgery
Sources
Also known as GHSA-5cp7-rvwq-5jc9.