Lucene search

WPScanCVE-2022-1409

HistoryMay 16, 2022 - 3:15 p.m.

CVE-2022-1409

2022-05-1615:15:09

CWE-434

WPScan

web.nvd.nist.gov

cve-2022-1409

vikbooking

hotel booking engine

pms

wordpress plugin

file validation

php files

security vulnerability

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

42.9%

JSON

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code

Affected configurations

Nvd

Vulners

Node

vikwphotel_booking_engine_\&_pmsRange<1.5.8wordpress

VendorProductVersionCPE
vikwphotel_booking_engine_\&_pms*cpe:2.3:a:vikwp:hotel_booking_engine_\&_pms:*:*:*:*:*:wordpress:*:*

Vendor	Product	Version	CPE
vikwp	hotel_booking_engine_\&_pms	*	cpe:2.3:a:vikwp:hotel_booking_engine_\&_pms::::::wordpress::*

CNA Affected

[
  {
    "product": "VikBooking Hotel Booking Engine & PMS",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.5.8",
        "status": "affected",
        "version": "1.5.8",
        "versionType": "custom"
      }
    ]
  }
]

References

wpscan.com/vulnerability/1330f8f7-4a59-4e9d-acae-21656a4101fe

Social References

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS

0.001

Percentile

42.9%

JSON

Related for CVE-2022-1409