CVE-2022-1753

A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument group_id allows posting messages in other groups. It is possible to launch the attack remotely but it might require authentication. A video explaining the attack has been disclosed to the public.

• CWE-284
• CWE-863

• https://vuldb.com/?id.199974Permissions Required, Third Party Advisory
• https://www.youtube.com/watch?v=tIzOZtp2fxAExploit, Third Party Advisory
• https://youtu.be/tIzOZtp2fxAExploit, Third Party Advisory
• https://vuldb.com/?id.199974Permissions Required, Third Party Advisory
• https://www.youtube.com/watch?v=tIzOZtp2fxAExploit, Third Party Advisory
• https://youtu.be/tIzOZtp2fxAExploit, Third Party Advisory

Published

May 17, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-1747The authentication mechanism used by voters to activate a vo…4.6
• CVE-2022-1748Softing OPC UA C++ Server SDK, Secure Integration Server, ed…7.5
• CVE-2022-1749The WPMK Ajax Finder WordPress plugin is vulnerable to Cross…8.8
• CVE-2022-1750The Sticky Popup plugin for WordPress is vulnerable to Store…4.8
• CVE-2022-1751The Skitter Slideshow plugin for WordPress is vulnerable to …7.2
• CVE-2022-1752Unrestricted Upload of File with Dangerous Type in GitHub re…8
• CVE-2022-1754Integer Overflow or Wraparound in GitHub repository polonel/…6.5
• CVE-2022-1755The SVG Support WordPress plugin before 2.5 does not properl…5.4
• CVE-2022-1756The Newsletter WordPress plugin before 7.4.5 does not saniti…6.1
• CVE-2022-1757The pagebar WordPress plugin before 2.70 does not have CSRF …5.4
• CVE-2022-1758The Genki Pre-Publish Reminder WordPress plugin through 1.4.…8.8
• CVE-2022-1759The RB Internal Links WordPress plugin through 2.0.16 does n…5.4