CVE-2022-3300 Form Maker by 10Web < 1.15.6 - Admin+ SQLI
An admin-level SQL injection in the Form Maker by 10Web WordPress plugin allows attackers to manipulate database queries.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-3300?
CVE-2022-3300 is a high-severity SQL injection vulnerability in Unknown Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder, published on 25 Oct 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
Weakness: CWE-89
Which versions are affected by CVE-2022-3300?
It affects 1 product.
Products include 10web Form Maker.
How do I fix CVE-2022-3300?
No fix has been published for CVE-2022-3300 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2022-3300 being exploited?
There is no known exploitation of CVE-2022-3300 in the wild and no public exploit code.
Other vulnerabilities in Unknown Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- CVE-2023-4666 Form-Maker < 1.15.20 - Unauthenticated Arbitrary File Upload
- CVE-2019-10866 SQL injection in n/a
- CVE-2019-11590 Cross-site request forgery in n/a
- CVE-2024-43220 WordPress Form Maker by 10Web plugin <= 1.15.26 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2023-45070 WordPress Form Maker by 10Web Plugin <= 1.15.18 is vulnerable to Cross Site Scripting (XSS)
Sources
Also known as GHSA-hpgh-grq3-j653.