CVE-2022-0739 BookingPress < 1.0.11 - Unauthenticated SQL Injection

2022-03-2118:56:00

CWE-89

WPScan

www.cve.org

0.006 Low

EPSS

Percentile

78.2%

JSON

The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection

CNA Affected

[
  {
    "product": "BookingPress – Appointments Booking Calendar Plugin and Online Scheduling Plugin",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.0.11",
        "status": "affected",
        "version": "1.0.11",
        "versionType": "custom"
      }
    ]
  }
]