PT-2023-10278 · Unknown · Cp Appointment Calendar Plugin

CVE-2015-10099 · Publicado 2023-04-10 · Atualizado 2024-05-17

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CP Appointment Calendar Plugin version 1.1.5 and earlier

Description A critical vulnerability has been found in the CP Appointment Calendar Plugin. This issue affects the dex process ready to go appointment function of the dex appointments.php file. The manipulation of the itemnumber argument leads to SQL injection. It is possible to initiate the attack remotely.

Recommendations To fix this issue, apply the patch named e29a9cdbcb0f37d887dd302a05b9e8bf213da01d. As a temporary workaround, consider restricting access to the dex appointments.php file or disabling the dex process ready to go appointment function until the patch is applied. Avoid using the itemnumber argument in the affected function until the issue is resolved.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2015-10099

Produtos afetados

Cp Appointment Calendar Plugin

Referências · 6

• https://github.com/wp-plugins/cp-appointment-calendar/commit/e29a9cdbcb0f37d887dd302a05b9e8bf213da01d · Correção
• https://t.me/cibsecurity/61747 · Publicação no Telegram
• https://vuldb.com/?id.225351 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-10099 · Nota de Segurança
• https://vuldb.com/?ctiid.225351 · Nota
• https://t.me/cvenotify/64328 · Publicação no Telegram