CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin.This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.72.
Explanation of Vulnerability in Simple Terms
BookingPress versions up to 1.0.72 contain a SQL injection vulnerability in the appointment booking workflow. An attacker with low-level user access can inject malicious SQL commands to read sensitive data from the site database, including customer information and booking records. The vulnerability does not require user interaction and can affect the entire site if the database is compromised.
What an attacker can do
Read sensitive data from the site database, including customer information and booking details.
Potential impact on your site
Customer data, booking records, and other sensitive database information could be exposed to attackers with basic site access.
Conditions required to exploit
Attacker must have a low-level user account (e.g., customer or subscriber role) on the site.
Key dates
External resources
Related vulnerabilities
