CVE-2022-0169: 10web Photo Gallery SQLi Vulnerability

CVE-2022-0169 Overview

CVE-2022-0169 is a critical SQL Injection vulnerability affecting the Photo Gallery by 10Web WordPress plugin before version 1.6.0. The vulnerability exists because the plugin does not properly validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action. This AJAX endpoint is accessible to both unauthenticated and authenticated users, allowing remote attackers to execute arbitrary SQL queries against the WordPress database without requiring any authentication.

Critical Impact

Unauthenticated attackers can exploit this SQL injection to extract sensitive database information, modify or delete data, and potentially achieve full database compromise on affected WordPress installations.

Affected Products

• 10Web Photo Gallery WordPress plugin versions prior to 1.6.0
• WordPress installations with the vulnerable Photo Gallery plugin installed
• Any website using the 10Web Photo Gallery plugin's frontend gallery functionality

Discovery Timeline

• 2022-03-14 - CVE-2022-0169 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0169

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) stems from improper input validation in the Photo Gallery by 10Web WordPress plugin. The vulnerable code path is accessible through the bwg_frontend_data AJAX action, which processes gallery-related requests on the frontend. When a user or attacker sends a request containing the bwg_tag_id_bwg_thumbnails_0 parameter, the plugin incorporates this value directly into a SQL query without proper sanitization or parameterized queries.

The attack requires no authentication and can be executed remotely over the network. An attacker can craft malicious HTTP requests containing SQL injection payloads in the vulnerable parameter, allowing them to manipulate database queries. Successful exploitation could lead to unauthorized access to sensitive data stored in the WordPress database, including user credentials, configuration data, and content from other plugins.

Root Cause

The root cause of this vulnerability is the failure to properly validate, sanitize, and escape user-supplied input before incorporating it into SQL queries. The bwg_tag_id_bwg_thumbnails_0 parameter is passed directly to a SQL statement without using WordPress's prepared statements or proper escaping functions like $wpdb->prepare(). This allows attackers to break out of the intended query context and inject arbitrary SQL commands.

Attack Vector

The attack is conducted over the network by sending crafted HTTP POST requests to the WordPress AJAX handler (/wp-admin/admin-ajax.php) with the action parameter set to bwg_frontend_data. The attacker includes a malicious payload in the bwg_tag_id_bwg_thumbnails_0 parameter, which is then executed as part of the SQL query.

Since the AJAX action does not require authentication, any remote attacker can exploit this vulnerability. The attack can be automated and requires no user interaction, making it particularly dangerous for publicly accessible WordPress sites. Attackers can use time-based blind SQL injection techniques or error-based methods to extract data from the database.

The vulnerability was addressed in version 1.6.0 through improved input validation. Technical details can be found in the WordPress Plugin Change Log and the WPScan Vulnerability Report.

Detection Methods for CVE-2022-0169

Indicators of Compromise

• Suspicious HTTP POST requests to /wp-admin/admin-ajax.php with action=bwg_frontend_data containing unusual characters in the bwg_tag_id_bwg_thumbnails_0 parameter
• Database query logs showing malformed or injected SQL statements originating from the Photo Gallery plugin
• Unexpected database activity such as data exfiltration patterns or unauthorized access to sensitive tables
• Web server access logs showing repeated requests to the AJAX endpoint with SQL injection patterns like ', ", UNION, SELECT, or SLEEP()

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in POST parameters targeting WordPress AJAX endpoints
• Monitor WordPress database query logs for anomalous queries containing injection signatures
• Deploy intrusion detection systems (IDS) with rulesets specifically designed to detect SQL injection attempts
• Utilize WordPress security plugins that provide real-time monitoring of AJAX requests and input validation

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests and regularly review logs for suspicious activity
• Set up alerts for unusual database query patterns or failed query attempts that may indicate injection attempts
• Monitor for unexpected changes to database tables, particularly user accounts or sensitive configuration data
• Implement rate limiting on AJAX endpoints to slow down automated exploitation attempts

How to Mitigate CVE-2022-0169

Immediate Actions Required

• Update the Photo Gallery by 10Web plugin to version 1.6.0 or later immediately
• If immediate patching is not possible, temporarily disable the Photo Gallery plugin until the update can be applied
• Review database logs and WordPress activity logs for any signs of prior exploitation
• Consider resetting database credentials and WordPress user passwords if exploitation is suspected

Patch Information

The vulnerability has been addressed in Photo Gallery by 10Web version 1.6.0. The fix implements proper input validation and sanitization for the bwg_tag_id_bwg_thumbnails_0 parameter before it is used in SQL queries. Administrators should update through the WordPress admin dashboard or manually download the patched version from the WordPress plugin repository.

For technical details about the patch, see the WordPress Plugin Change Log.

Workarounds

• Deploy a Web Application Firewall (WAF) with rules to block SQL injection patterns targeting the vulnerable AJAX action
• Temporarily restrict access to /wp-admin/admin-ajax.php for unauthenticated users if the gallery functionality is not required for public visitors
• Implement server-level input filtering to sanitize requests containing known SQL injection patterns
• Consider using WordPress security plugins that provide virtual patching capabilities for known vulnerabilities

# Example WAF rule to block suspicious requests to the vulnerable endpoint
# For Apache mod_security:
SecRule ARGS:bwg_tag_id_bwg_thumbnails_0 "@detectSQLi" \
  "id:100001,phase:2,deny,status:403,msg:'SQL Injection attempt blocked in Photo Gallery plugin'"

# For nginx with ModSecurity:
# Add to your security rules configuration
# location /wp-admin/admin-ajax.php {
#   modsecurity on;
#   modsecurity_rules_file /etc/nginx/modsecurity/sql-injection-rules.conf;
# }