CVEs-PoC/2022/CVE-2022-4357.md

CVE-2022-4357

Description

The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

POC

Reference

• https://wpscan.com/vulnerability/4d1c0886-11f7-494f-b175-691253f46626
• https://wpscan.com/vulnerability/4d1c0886-11f7-494f-b175-691253f46626/

Github

• https://github.com/20142995/nuclei-templates