CVE-2022-0747 — AI Deep Analysis Summary

🚨 **Essence**: SQL Injection in WordPress plugin 'Infographic Maker'. 💥 **Consequences**: Attackers can inject malicious SQL code via the `post_id` parameter. 📉 **Impact**: Potential data theft, modification, or deletion…

🛡️ **CWE**: CWE-89 (SQL Injection). 🔍 **Flaw**: Lack of validation and escaping for the `post_id` parameter. ⚠️ **Trigger**: Occurs during the `qcld_upvote_action` AJAX operation.

📦 **Product**: Infographic Maker – iList (WordPress Plugin). 📅 **Affected**: Versions **before 4.3.8**. 🌐 **Platform**: WordPress sites using this specific plugin version.

🕵️ **Privileges**: **Unauthenticated** access allowed! No login required. 🗄️ **Data**: Full access to the underlying MySQL database. 🔓 **Risk**: Can read sensitive user data, admin credentials, or alter site content.

📉 **Threshold**: **LOW**. 🔑 **Auth**: None required (Unauthenticated). ⚙️ **Config**: Standard WordPress setup with the vulnerable plugin is enough. 🚀 **Ease**: Simple AJAX request manipulation.

✅ **Yes**, Public PoC available. 🔗 **Source**: Nuclei templates (ProjectDiscovery). 🌍 **Status**: Known exploit pattern exists in security databases (WPScan).

🔍 **Check**: Scan for `Infographic Maker` plugin version. 🛠️ **Tool**: Use Nuclei or WPScan to detect version < 4.3.8. 📡 **Test**: Look for SQL errors in responses from `qcld_upvote_action` endpoint.

✅ **Fixed**: Yes, in version **4.3.8** and later. 📝 **Patch**: Developers validated and escaped the `post_id` input. 🔄 **Action**: Update the plugin immediately to the latest version.

🚫 **Workaround**: Disable the plugin if not needed. 🛡️ **WAF**: Deploy Web Application Firewall rules to block SQLi patterns in AJAX requests. 🔒 **Access Control**: Restrict access to WordPress admin area (though this vu…

🔥 **Priority**: **HIGH**. ⏱️ **Urgency**: Critical due to **Unauthenticated** nature. 🚀 **Action**: Patch immediately. No login needed for exploitation makes it easy for automated bots.