CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L
What the vulnerability does
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | BookIt.This issue affects Booking Calendar | Appointment Booking | BookIt: from n/a through 2.4.3.
Explanation of Vulnerability in Simple Terms
A SQL injection vulnerability in Booking Calendar allows authenticated administrators to execute arbitrary SQL queries against the site database. An attacker with high-level admin privileges can read sensitive data or disrupt database operations. The vulnerability requires admin access and does not affect data integrity. Update to a version newer than 2.4.3.
What an attacker can do
Execute SQL queries to read database contents or cause service disruption.
Potential impact on your site
Admin accounts are at risk; compromised admins can extract sensitive data or degrade site availability.
Conditions required to exploit
Attacker must have high-level administrator privileges on the site.
Key dates
External resources
Related vulnerabilities
