PT-2023-30258 · WordPress · Wordpress Online Booking/Scheduling Plugin

Pablo Sanchez · Publicado 2023-10-16 · Atualizado 2023-10-20 · CVE-2023-4691

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The WordPress Online Booking and Scheduling Plugin versions prior to 22.4

Description The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection. This can be exploited by high privilege users such as admin.

Recommendations For versions prior to 22.4, update to version 22.4 or later to resolve the issue. As a temporary workaround, consider restricting access to high privilege users until the update is applied.

Exploit

Correção

Identificadores relacionados

CVE-2023-4691

Produtos afetados

Wordpress Online Booking/Scheduling Plugin

Referências · 4

• 🔥 https://wpscan.com/vulnerability/5085ec75-0795-4004-955d-e71b3d2c26c6 · Exploit
• https://osv.dev/vulnerability/CVE-2023-4691 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/1714006538371674120 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-4691 · Nota de Segurança