PT-2015-7521 · WordPress · Appointment Booking Calendar

Publicado 2015-09-29 · Atualizado 2018-10-09 · CVE-2015-7319

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar plugin versions prior to 1.1.8

Description The issue allows remote attackers to execute arbitrary SQL commands. This is related to updating the username via unspecified vectors in the cpabc appointments admin int calendar list.inc.php file.

Recommendations For versions prior to 1.1.8, update to version 1.1.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the cpabc appointments admin int calendar list.inc.php file until a patch is applied. Avoid using the username variable in related API endpoints until the issue is resolved.

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-7319

Produtos afetados

Appointment Booking Calendar

Referências · 6

• https://wordpress.org/plugins/appointment-booking-calendar/changelog · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7319 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7319 · Nota de Segurança
• http://packetstormsecurity.com/files/133757/WordPress-Appointment-Booking-Calendar-1.1.7-SQL-Injection.html · Nota
• http://securityfocus.com/archive/1/536555/100/0/threaded · Nota
• https://wpvulndb.com/vulnerabilities/8199 · Nota