CVE-2022-1950 Scanner

Youzify is a popular WordPress plugin used to enhance community engagement by providing user profiles, social walls, and various widgets. It is widely used by developers and community managers to create interactive and engaging WordPress sites. The plugin is often utilized in forums and community-centric websites to add functionality and enhance user experience. It provides extensive customization options and is valued for its ability to integrate seamlessly with other WordPress plugins and platforms. Administrators use Youzify to create engaging, socially interactive websites with ease, making it a preferred choice for building online communities.

SQL Injection is a common web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. This vulnerability can lead to unauthorized viewing of data, bypassing authentication, and even modifying or deleting data. It occurs when user input is not correctly sanitized before being incorporated into a SQL query. The detected vulnerability in Youzify allows unauthenticated users to exploit the plugin through an AJAX action that is insufficiently sanitized for specific parameters. Consequently, the vulnerability exposes the system to potential database manipulations and data breaches.

The SQL Injection vulnerability in Youzify is associated with the improper sanitization and escaping of a parameter utilized in a SQL statement via an AJAX action. Specifically, the flaw exists in the 'youzify_media_pagination' action, which includes vulnerable parameters such as 'type' and 'group_id' that can be manipulated to inject SQL code. Attackers can initiate this SQL code execution without authentication, leading to database sleep operations as demonstrated in the {SELECT(SLEEP(6))}. Additionally, this shows evidence of the vulnerability as the requested SQL operation results in a delayed response time, confirming the susceptibility of the system. The flaw affects users with versions of Youzify prior to version 1.2.0.

If an attacker successfully exploits the SQL Injection vulnerability in Youzify, they can manipulate database queries to access sensitive information. This might result in unauthorized data exposure, alteration, or deletion affecting both site content and user data. Additionally, exploiting this vulnerability can result in performance disruptions as resource-heavy SQL queries might overload the server. In worst-case scenarios, the attacker could use their access to perform privilege escalation or gain admin-level control over the WordPress site. The impact is extensive, potentially compromising the integrity, confidentiality, and availability of the database and its related services.

REFERENCES

• https://wpscan.com/vulnerability/4352283f-dd43-4827-b417-0c55d0f4637d/