cve/2022/CVE-2022-0267.md

### [CVE-2022-0267](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0267)
![](https://img.shields.io/static/v1?label=Product&message=AdRotate%20%E2%80%93%20Ad%20manager%20%26%20AdSense%20Ads&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=5.8.22%3C%205.8.22%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-89%20SQL%20Injection&color=brighgreen)

### Description

The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection

### POC

#### Reference
- https://wpscan.com/vulnerability/7df70f49-547f-4bdb-bf9b-2e06f93488c6

#### Github
- https://github.com/ARPSyndicate/cvemon