advanced_booking_calendar 漏洞

严重2023/10/20

Advanced Booking Calendar < 1.6.2 - SQL Injection

The AJAX action abc_booking_getBookingResult, available to both authenticated and Unauthenticated users did not sanitise the calendarId parameter which was then concatenated to a SQL statement, leading an unauthenticated SQL injection issue. This could be used to retrieve information from the database, such as users' hashed password, username and email address.

advanced_booking_calendarPoC 已收录

CVSS—

中危CVE-2022-10072022/04/11

WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting

WordPress Advanced Booking Calendar plugin before 1.7.1 contains a cross-site scripting vulnerability. It does not sanitize and escape the room parameter before outputting it back in an admin page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

advanced_booking_calendarPoC 已收录

CVSS6.1EPSS 2.5%

advanced_booking_calendar

关联漏洞

Advanced Booking Calendar < 1.6.2 - SQL Injection

WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting