Описание
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks
Ссылки
- PatchThird Party Advisory
- ExploitPatchThird Party Advisory
- PatchThird Party Advisory
- ExploitPatchThird Party Advisory
Уязвимые конфигурации
Конфигурация 1Версия до 1.7.1 (исключая)
cpe:2.3:a:elbtide:advanced_booking_calendar:*:*:*:*:*:wordpress:*:*
EPSS
Процентиль: 70%
0.0062
Низкий
7.2 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-89
Связанные уязвимости
CVSS3: 7.2
github
почти 4 года назад
The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks
EPSS
Процентиль: 70%
0.0062
Низкий
7.2 High
CVSS3
6.5 Medium
CVSS2
Дефекты
CWE-89