by Kastro
Paper/Archive/CVE-2022-3982

CVE-2022-3982

Unknown Booking calendar, Appointment Booking System — Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload

EPSS 5%public exploitCVSS 9.8
critical.is priorityof 100
58
CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 92.0.920 × 2018.4Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE

Affected

ProductAffectedFixed inSource
Booking calendar, Appointment Booking System< 3.2.23.2.2CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/4d91f3e1-4de9-46c1-b5ba-cc55b7726867