.. / CVE-2022-4059

• SQLi
• Nuclei
• Web

Exploit for Cryptocurrency Widgets Pack < 2.0 - SQL Injection (CVE-2022-4059)

Description:

The plugin does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Nuclei Template

View the template here CVE-2022-4059.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-4059.yaml

References: