PT-2022-18648 · E4J S.R.L. · Vikbooking Hotel Booking Engine & Pms

Huli · Published 2022-04-19 · Updated 2022-04-28 · CVE-2022-27862

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin version 1.5.3 and earlier

Description The issue allows for Arbitrary File Upload leading to Remote Code Execution (RCE) via the signature upload on the booking form, enabling attackers to upload and execute dangerous file types, such as PHP shells.

Recommendations For versions 1.5.3 and earlier, update to a version later than 1.5.3 to resolve the issue. As a temporary workaround, consider disabling the signature upload feature on the booking form until a patch is available. Restrict access to the booking form to minimize the risk of exploitation. Avoid using the vulnerable plugin until the issue is resolved.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-27862

Affected Products

Vikbooking Hotel Booking Engine & Pms

References · 4

• https://wordpress.org/plugins/vikbooking/#developers · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27862 · Security Note
• https://patchstack.com/database/vulnerability/vikbooking/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-5-3-arbitrary-file-upload-leading-to-rce · Note