.. / CVE-2022-0785

• SQLi
• Nuclei
• Web

Exploit for WordPress Daily Prayer Time <2022.03.01 - SQL Injection (CVE-2022-0785)

Description:

WordPress Daily Prayer Time plugin prior to 2022.03.01 contains a SQL injection vulnerability.. It does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthly_timetable AJAX action, available to unauthenticated users, leading to SQL injection.

Nuclei Template

View the template here CVE-2022-0785.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-0785.yaml

References: