Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2022-0739

BookingPress < 1.0.11 - Unauthenticated SQL Injection

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 1.0.11
1 Metasploit module, 9 proofs of concept on GitHub

Summary

The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection

Timeline

  1. CVE published
  2. Record last updated
  3. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • Unknown BookingPress – Appointments Booking Calendar Plugin and Online Scheduling Plugin

    From 1.0.11 · fixed in 1.0.11

References 12

wpscan.com

plugins.trac.wordpress.org

GitHub · rapid7/metasploit-framework

GitHub · BKreisel/CVE-2022-0739

GitHub · Chris01s/CVE-2022-0739

GitHub · ElGanz0/CVE-2022-0739

GitHub · G01d3nW01f/CVE-2022-0739

GitHub · Manjen1218/CVE-2022-0739-Exploitation

GitHub · destr4ct/CVE-2022-0739

GitHub · hadrian3689/wp_bookingpress_1.0.11

GitHub · lhamouche/Bash-exploit-for-CVE-2022-0739

GitHub · viardant/CVE-2022-0739