Cyber Resilience

CVE-2022-2840

CriticalPublic PoC

Published: 19 September 2022

Published
19 September 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0385 88.5th percentile
Risk Priority 22 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-2840 is a critical-severity SQL Injection (CWE-89) vulnerability in Zephyr-One Zephyr Project Manager. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 11.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The Zephyr Project Manager WordPress plugin before version 3.2.5 contains an SQL injection vulnerability tracked as CVE-2022-2840. The root cause is insufficient sanitization and escaping of parameters supplied to SQL statements across multiple AJAX actions that are reachable by both unauthenticated and authenticated users, corresponding to CWE-89 and carrying a CVSS 3.1 score of 9.8.

An attacker can invoke the exposed AJAX endpoints with crafted input to execute arbitrary SQL commands against the underlying database. Successful exploitation can result in disclosure, modification, or deletion of stored data and, given the high CVSS vector, may lead to full application or server compromise without requiring authentication or user interaction.

Public proof-of-concept material and technical write-ups are available from PacketStorm and WPScan. The associated EPSS score reached a peak of 0.0518 before receding to its current value of 0.0385.

EU & UK References

Vulnerability details

The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

zephyr-one
zephyr project manager
≤ 3.2.5

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References