PT-2022-13170 · WordPress · Five Star Restaurant Reservations

Krzysztof Zając · Published 2022-11-21 · Updated 2023-07-04 · CVE-2022-0421

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Five Star Restaurant Reservations WordPress plugin versions prior to 2.4.12

Description The issue allows unauthenticated users to change the payment status of arbitrary bookings due to a lack of authorization. Additionally, it enables attackers to perform Cross-Site Scripting attacks against logged-in admins viewing failed payments because of insufficient sanitization and escaping.

Recommendations For versions prior to 2.4.12, update to version 2.4.12 or later to resolve the issue. As a temporary workaround, consider restricting access to the payment status change functionality until the update is applied. Avoid using the plugin's payment management features with untrusted users until the issue is resolved.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2022-0421

Affected Products

Five Star Restaurant Reservations

References · 5

• 🔥 https://wpscan.com/vulnerability/145e8d3c-cd6f-4827-86e5-ea2d395a80b9 · Exploit
• https://osv.dev/vulnerability/CVE-2022-0421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0421 · Security Note
• https://t.me/cvenotify/53626 · Telegram Post
• https://t.me/cvenotify/38151 · Telegram Post