CVE-2022-2840
Published: 19 September 2022
Summary
CVE-2022-2840 is a critical-severity SQL Injection (CWE-89) vulnerability in Zephyr-One Zephyr Project Manager. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 11.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Zephyr Project Manager WordPress plugin before version 3.2.5 contains an SQL injection vulnerability tracked as CVE-2022-2840. The root cause is insufficient sanitization and escaping of parameters supplied to SQL statements across multiple AJAX actions that are reachable by both unauthenticated and authenticated users, corresponding to CWE-89 and carrying a CVSS 3.1 score of 9.8.
An attacker can invoke the exposed AJAX endpoints with crafted input to execute arbitrary SQL commands against the underlying database. Successful exploitation can result in disclosure, modification, or deletion of stored data and, given the high CVSS vector, may lead to full application or server compromise without requiring authentication or user interaction.
Public proof-of-concept material and technical write-ups are available from PacketStorm and WPScan. The associated EPSS score reached a peak of 0.0518 before receding to its current value of 0.0385.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-35074
Vulnerability details
The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.