The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks
References
Link | Resource |
---|---|
https://plugins.trac.wordpress.org/changeset/2695427 | Patch Third Party Advisory |
https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68 | Exploit Patch Third Party Advisory |
https://plugins.trac.wordpress.org/changeset/2695427 | Patch Third Party Advisory |
https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68 | Exploit Patch Third Party Advisory |
Configurations
History
21 Nov 2024, 06:39
Type | Values Removed | Values Added |
---|---|---|
References | () https://plugins.trac.wordpress.org/changeset/2695427 - Patch, Third Party Advisory | |
References | () https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68 - Exploit, Patch, Third Party Advisory |
Information
Published : 2022-04-11 15:15
Updated : 2024-11-21 06:39
NVD link : CVE-2022-1006
Mitre link : CVE-2022-1006
CVE.ORG link : CVE-2022-1006
JSON object : View
Products Affected
elbtide
- advanced_booking_calendar
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')