Paper/Archive/CVE-2022-47428

CVE-2022-47428

WpDevArt Booking calendar, Appointment Booking System — WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection

EPSS 0.7%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (NVD, ADP agree)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 52.2.522 × 2010.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System allows SQL Injection.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.7.

Affected

ProductAffectedFixed inSource

Booking calendar, Appointment Booking Systemn/a – 3.2.7–CNA

booking_calendar≤ 3.2.7–CISA-ADP

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Patchstack (CNA)6.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refpatchstack.com/database/vulnerability/booking-calendar/wordpress-booking-calendar-appointment-booking-system-plugin-3-2-6-sql-injection?_s_id=cve