CVE-2022-0267CWE-89

CVE-2022-0267: vulnerability in AdRotate – Ad manager & AdSense Ads

AdRotate < 5.8.22 - Admin+ SQL Injection

Published · Updated

Follow this CVE+ Monitor AdRotate – Ad manager & AdSense Ads

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

3Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackepss 1.3%
The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection
Affected products
Unknown · AdRotate – Ad manager & AdSense Ads
Related CVEs — AdRotate – Ad manager & AdSense Ads

In the same product, most dangerous first.

CVE-2022-0662—Adrotate < 5.8.23 - Admin+ XSS via Advert NameEPSS 0.6%CVE-2022-0649—Adrotate < 5.8.23 - Admin+ XSS via Group NameEPSS 0.6%