Lucene search
Bob MatyasWPVDB-ID:1C6812D8-A218-4C15-9E2D-D43F3F3B0E78HistoryApr 05, 2024 - 12:00 a.m.
Salon booking system < 9.6.6 - Settings Update via CSRF
2024-04-0500:00:00
Bob Matyas
wpscan.com
5
salon booking system
settings update
csrf
attackers
admin
poc
software
Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
PoC
Make an admin open a page containing the code:
| CPE | Name | Operator | Version |
|---|---|---|---|
| eq | 9.6.6 |
Related
cvelist
cvelist
CVE-2024-2429 Salon booking system <= 9.6.5 - Settings Update via CSRF
2024-04-26 05:00:02
wpexploit
wpexploit
Salon booking system < 9.6.6 - Settings Update via CSRF
2024-04-05 00:00:00
cve
cve
CVE-2024-2429
2024-04-26 05:15:50
nvd
nvd
CVE-2024-2429
2024-04-26 05:15:50
wordfence
wordfence
6.4 Medium
AI Score
Confidence
High
0.0004 Low
EPSS
Percentile
9.1%
Related for WPVDB-ID:1C6812D8-A218-4C15-9E2D-D43F3F3B0E78