{"containers": {"cna": {"affected": [{"product": "Five Minute Webshop", "vendor": "Unknown", "versions": [{"lessThanOrEqual": "1.3.2", "status": "affected", "version": "1.3.2", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Daniel Krohmer (Fraunhofer IESE)"}, {"lang": "en", "value": "Shi Chen (University of Kaiserslautern)"}], "descriptions": [{"lang": "en", "value": "The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection"}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 SQL Injection", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-06T08:51:18", "orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97"}, {"tags": ["x_refsource_MISC"], "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1"}], "source": {"discovery": "EXTERNAL"}, "title": "Five Minute Webshop <= 1.3.2 - Admin+ SQLi via orderby", "x_generator": "WPScan CVE Generator", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "contact@wpscan.com", "ID": "CVE-2022-1685", "STATE": "PUBLIC", "TITLE": "Five Minute Webshop <= 1.3.2 - Admin+ SQLi via orderby"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Five Minute Webshop", "version": {"version_data": [{"version_affected": "<=", "version_name": "1.3.2", "version_value": "1.3.2"}]}}]}, "vendor_name": "Unknown"}]}}, "credit": [{"lang": "eng", "value": "Daniel Krohmer (Fraunhofer IESE)"}, {"lang": "eng", "value": "Shi Chen (University of Kaiserslautern)"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection"}]}, "generator": "WPScan CVE Generator", "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-89 SQL Injection"}]}]}, "references": {"reference_data": [{"name": "https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97", "refsource": "MISC", "url": "https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97"}, {"name": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1", "refsource": "MISC", "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1"}]}, "source": {"discovery": "EXTERNAL"}}}}, "cveMetadata": {"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "assignerShortName": "WPScan", "cveId": "CVE-2022-1685", "datePublished": "2022-06-06T08:51:19", "dateReserved": "2022-05-12T00:00:00", "dateUpdated": "2022-06-06T08:51:18", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:five_minute_webshop_project:five_minute_webshop:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "D23E7DAD-EF6C-491B-A624-0DD9A3A71677", "versionEndIncluding": "1.3.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection"}, {"lang": "es", "value": "El plugin Five Minute Webshop de WordPress versiones hasta 1.3.2, no comprueba ni escapa del par\u00e1metro orderby antes de usarlo en una sentencia SQL por medio de la p\u00e1gina de administraci\u00f3n Manage Products, conllevando a una inyecci\u00f3n SQL"}], "id": "CVE-2022-1685", "lastModified": "2022-06-15T16:53:00.687", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-08T10:15:10.227", "references": [{"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1"}, {"source": "contact@wpscan.com", "tags": ["Exploit", "Third Party Advisory"], "url": "https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "contact@wpscan.com", "type": "Primary"}]}

{}