PT-2022-18649 · E4J S.R.L. · Vikbooking Hotel Booking Engine & Pms

Huli · Published 2022-04-19 · Updated 2022-04-28 · CVE-2022-27863

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin versions <= 1.5.3

Description The issue allows attackers to obtain booking data by guessing or brute-forcing easily predictable booking IDs via search POST requests to API endpoints such as /api/search. The booking id variable is vulnerable to this type of attack. This can lead to sensitive information exposure.

Recommendations For E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin versions <= 1.5.3, update to a version greater than 1.5.3 to resolve the issue. As a temporary workaround, consider restricting access to the search functionality to minimize the risk of exploitation. Avoid using easily predictable booking id values in the affected API endpoint until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2022-27863

Affected Products

Vikbooking Hotel Booking Engine & Pms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-27863 · Security Note
• https://wordpress.org/plugins/vikbooking/#developers · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-27863 · Vendor Advisory
• https://patchstack.com/database/vulnerability/vikbooking/wordpress-vikbooking-hotel-booking-engine-pms-plugin-1-5-3-sensitive-data-exposure-vulnerability · Note
• https://t.me/cibsecurity/41131 · Telegram Post