CVE-2022-1409

🗓️ 16 May 2022 14:30:58Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 73 Views🌐 WEB

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 allows high privilege users to upload PHP file

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2022-1409	16 May 202215:15	–	attackerkb
Circl	CVE-2022-1409	16 May 202218:26	–	circl
CNNVD	WordPress plugin VikBooking Hotel Booking Engine & PMS 代码问题漏洞	16 May 202200:00	–	cnnvd
CNVD	WordPress VikBooking Hotel Booking Engine	18 May 202200:00	–	cnvd
Cvelist	CVE-2022-1409 VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload	16 May 202214:30	–	cvelist
EUVD	EUVD-2022-24725	3 Oct 202520:07	–	euvd
NVD	CVE-2022-1409	16 May 202215:15	–	nvd
OSV	CVE-2022-1409	16 May 202215:15	–	osv
Patchstack	WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.5.6 - PHP File Upload vulnerability	21 Apr 202200:00	–	patchstack
Prion	Code injection	16 May 202215:15	–	prion

NVD

Vulners

Node

vikwp hotel_booking_engine_&_pmsRange<1.5.8wordpress

[
  {
    "product": "VikBooking Hotel Booking Engine & PMS",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.5.8",
        "status": "affected",
        "version": "1.5.8",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/1330f8f7-4a59-4e9d-acae-21656a4101fe

Parameter	Position	Path	Description	CWE
caraticon	request body	/wp-admin/admin.php	Upload of a PHP file disguised as an image via the caraticon field leading to execution of PHP code on the server.	CWE-434