CVE-2022-3302: 
WordPress vulnerability analysis and mitigation

The Anti-Spam by CleanTalk WordPress plugin versions before 5.185.1 contains a SQL injection vulnerability identified as CVE-2022-3302. The vulnerability affects high-privilege users such as administrators and was publicly disclosed on October 3, 2022. The issue exists in the plugin's spam logs deletion functionality (WPScan).

The vulnerability stems from improper validation of IDs before using them in SQL statements within the spam logs deletion feature. The issue is specifically located in the /edit-comments.php?page=ct_check_spam_logs endpoint. The vulnerability has been assigned a CVSS score of 6.8 (medium) and is classified under CWE-89 (SQL Injection). It falls under the OWASP Top 10 category A1: Injection (WPScan).

When exploited, this vulnerability could allow authenticated administrators to perform SQL injection attacks through the manipulation of the spamids[] parameter in the spam logs deletion functionality. This could potentially lead to unauthorized database access or manipulation (WPScan).

The vulnerability can be exploited by intercepting and modifying requests to the spam logs deletion endpoint. A proof of concept demonstrates that by changing the spamids[] parameter to include a malicious SQL payload, an attacker can execute SQL commands, such as causing delays through the SLEEP function (WPScan).

The vulnerability has been patched in version 5.185.1 of the Anti-Spam by CleanTalk plugin. Users are advised to update to this version or later to mitigate the risk (WPScan).