Booking calendar, Appointment Booking System, 6f0ffeb2d43a9a7250e0fd22cd99cfdabb07e110

CVE, Research URL: 6f0ffeb2d43a9a7250e0fd22cd99cfdabb07e110
Home page URL: Security reports for Booking calendar, Appointment Booking System
Application: Booking calendar, Appointment Booking System
Published on: Oct 29, 2023
Research Description: Booking calendar, Appointment Booking System [booking-calendar] < 3.2.12 Booking Calendar WpDevArt <= 3.2.11 - Authenticated (Admin+) SQL Injection The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to SQL Injection via the '$email_address' variable in all versions up to, and including, 3.2.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
Affected versions: max 3.2.12.
Status: vulnerable