PT-2024-36100 · Roninwp · Roninwp Fat Services Booking

Dave Jong · Published 2024-12-04 · Updated 2024-12-05 · CVE-2024-54221

Positive Technologies (AI Summary)

CVSS v3.1

9.3

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions: Roninwp FAT Services Booking versions n/a through 5.6

Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as a SQL Injection vulnerability. This problem impacts Roninwp FAT Services Booking, allowing for potential SQL injection attacks. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

Recommendations: For versions n/a through 5.6, update to a version that addresses this SQL Injection vulnerability. As a temporary workaround, consider restricting access to sensitive database queries or inputs that may be used to exploit the SQL injection vulnerability until a patch is available.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-54221

Affected Products

Roninwp Fat Services Booking

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-54221 · Security Note
• https://twitter.com/CveFindCom/status/1864460936834105354 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/fat-services-booking/vulnerability/wordpress-fat-services-booking-plugin-5-6-unauthenticated-sql-injection-vulnerability?_s_id=cve · Note
• https://twitter.com/VulmonFeeds/status/1864524766029242448 · Twitter Post
• https://t.me/cvedetector/12042 · Telegram Post
• https://twitter.com/CVEnew/status/1864455137978089661 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/fat-services-booking/vulnerability/wordpress-fat-services-booking-plugin-5-6-unauthenticated-sql-injection-vulnerability?_s_id=cve · Note