CVE-2022-3494 Complianz (Free < 6.3.4, Premium < 6.3.6) - Translator SQLi

What is CVE-2022-3494?

CVE-2022-3494 is a high-severity SQL injection vulnerability in Unknown Complianz Premium, published on 7 Nov 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML.

Weakness: CWE-89

Which versions are affected by CVE-2022-3494?

It affects 1 product.

Products include Really-Simple-Plugins Complianz.

How do I fix CVE-2022-3494?

No fix has been published for CVE-2022-3494 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-3494 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-3494 exists.

Other vulnerabilities in Unknown Complianz Premium

• CVE-2023-33333 Cross-site request forgery in Complianz High 7.1
• CVE-2023-34030 WordPress Complianz and Complianz Premium plugins - Cross Site Request Forgery (CSRF) Medium 6.5
• CVE-2022-0193 Complianz - GDPR/CCPA Cookie Consent < 6.0.0 - Reflected Cross-Site Scripting Medium 6.1
• CVE-2023-1069 Complianz - GDPR/CCPA Cookie Consent < 6.4.2 - Contributor+ Stored XSS Medium 5.4
• CVE-2023-6498 Complianz | GDPR/CCPA Cookie Consent <= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settings Medium 4.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-49q7-gc3f-7wp4.