CVE-2024-10856

The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the `id` parameter in the “wpdevart_booking_calendar” shortcode in versions up to, and including, 3.2.19 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The vulnerability requires the “delete_prev_date” theme option being enabled. This makes it possible for authenticated attackers, with contributor-level access or above, to append additional SQL queries into already existing query that can be used to extract sensitive information such as passwords from the database.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/booking-calendar/tags/3.2.15/includes/main_class.php#L90	Product
https://plugins.trac.wordpress.org/browser/booking-calendar/tags/3.2.15/includes/main_class.php#L91	Product
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209851%40booking-calendar&new=3209851%40booking-calendar&sfp_email=&sfph_mail=	Patch
https://www.wordfence.com/threat-intel/vulnerabilities/id/bf297cd8-3d67-4750-b856-38ded4daf4ad?source=cve	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wpdevart:booking_calendar:*:*:*:*:*:wordpress:*:*

History

No history.

Information

Published : 2024-12-24 11:15

Updated : 2025-03-21 18:50

NVD link : CVE-2024-10856

Mitre link : CVE-2024-10856

CVE.ORG link : CVE-2024-10856

JSON object : View

Products Affected

wpdevart

booking_calendar

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2024-10856", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "[email protected]", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2024-12-24T11:15:07.260", "references": [{"url": "https://plugins.trac.wordpress.org/browser/booking-calendar/tags/3.2.15/includes/main_class.php#L90", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/booking-calendar/tags/3.2.15/includes/main_class.php#L91", "tags": ["Product"], "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3209851%40booking-calendar&new=3209851%40booking-calendar&sfp_email=&sfph_mail=", "tags": ["Patch"], "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bf297cd8-3d67-4750-b856-38ded4daf4ad?source=cve", "tags": ["Third Party Advisory"], "source": "[email protected]"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "The Booking Calendar WpDevArt plugin is vulnerable to time-based, blind SQL injection via the `id` parameter in the \u201cwpdevart_booking_calendar\u201d shortcode in versions up to, and including, 3.2.19 due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. The vulnerability requires the \u201cdelete_prev_date\u201d theme option being enabled. This makes it possible for authenticated attackers, with contributor-level access or above, to append additional SQL queries into already existing query that can be used to extract sensitive information such as passwords from the database."}, {"lang": "es", "value": "El complemento Booking Calendar WpDevArt es vulnerable a la inyecci\u00f3n SQL ciega basada en el tiempo a trav\u00e9s del par\u00e1metro `id` en el c\u00f3digo corto \u201cwpdevart_booking_calendar\u201d en versiones hasta la 3.2.19 incluida debido a un escape insuficiente en el par\u00e1metro proporcionado por el usuario y a la falta. de suficiente preparaci\u00f3n sobre la consulta SQL existente. La vulnerabilidad requiere que se habilite la opci\u00f3n de tema \"delete_prev_date\". Esto hace posible que los atacantes autenticados, con acceso de nivel de colaborador o superior, agreguen consultas SQL adicionales a consultas ya existentes que pueden usarse para extraer informaci\u00f3n confidencial, como contrase\u00f1as, de la base de datos."}], "lastModified": "2025-03-21T18:50:57.490", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wpdevart:booking_calendar:*:*:*:*:*:wordpress:*:*", "vulnerable": true, "matchCriteriaId": "341363DD-63BD-478F-BC50-E012CA8643B9", "versionEndExcluding": "3.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "[email protected]"}