CVE-2018-20556

Опубликовано: 21 мар. 2019

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Средний

Описание

SQL injection vulnerability in Booking Calendar plugin 8.4.3 for WordPress allows remote attackers to execute arbitrary SQL commands via the booking_id parameter.

Ссылки

http://packetstormsecurity.com/files/151692/WordPress-Booking-Calendar-8.4.3-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
https://gist.github.com/B0UG/a750c2c204825453e6faf898ea6d09f6
https://vulners.com/exploitdb/EDB-ID:46377
https://www.exploit-db.com/exploits/46377/
Exploit
Third Party Advisory
VDB Entry
http://packetstormsecurity.com/files/151692/WordPress-Booking-Calendar-8.4.3-SQL-Injection.html
Exploit
Third Party Advisory
VDB Entry
https://gist.github.com/B0UG/a750c2c204825453e6faf898ea6d09f6
https://vulners.com/exploitdb/EDB-ID:46377
https://www.exploit-db.com/exploits/46377/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:booking_calendar_project:booking_calendar:8.4.3:*:*:*:*:wordpress:*:*

EPSS

Процентиль: 94%

0.14445

Средний

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-89

Связанные уязвимости

GHSA-44p6-8579-mh2w