cve/2022/CVE-2022-0349.md

### [CVE-2022-0349](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0349)
![](https://img.shields.io/static/v1?label=Product&message=NotificationX%20%E2%80%93%20Best%20FOMO%2C%20Social%20Proof%2C%20WooCommerce%20Sales%20Popup%20%26%20Notification%20Bar%20Plugin%20With%20Elementor&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=2.3.9%3C%202.3.9%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brighgreen)

### Description

The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection

### POC

#### Reference
- https://wpscan.com/vulnerability/1d0dd7be-29f3-4043-a9c6-67d02746463a

#### Github
- https://github.com/20142995/sectool
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/edoardottt/nuclei-cve-gpt