Appointment Booking Calendar Plugin up to 1.3.34 on WordPress cpabc_appointments.php Stored cross site scripting

Summaryinfo

A vulnerability has been found in Appointment Booking Calendar Plugin up to 1.3.34 on WordPress and classified as problematic. Impacted is an unknown function of the file cpabc_appointments.php. The manipulation leads to cross site scripting (Stored). This vulnerability is documented as CVE-2020-9371. The attack can be initiated remotely. Additionally, an exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Appointment Booking Calendar Plugin up to 1.3.34 on WordPress (Appointment Software) and classified as problematic. This issue affects an unknown part of the file cpabc_appointments.php. The manipulation with an unknown input leads to a cross site scripting vulnerability (Stored). Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

Stored XSS exists in the Appointment Booking Calendar plugin before 1.3.35 for WordPress. In the cpabc_appointments.php file, the Calendar Name input could allow attackers to inject arbitrary JavaScript or HTML.

The weakness was released 03/04/2020. The identification of this vulnerability is CVE-2020-9371 since 02/24/2020. The attack may be initiated remotely. A simple authentication is necessary for exploitation. It demands that the victim is doing some kind of user interaction. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1059.007 for this issue.

The exploit is available at exploit-db.com. It is declared as proof-of-concept. By approaching the search of inurl:cpabc_appointments.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 1.3.35 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Exploit-DB (48204). Entry connected to this vulnerability is available at VDB-150882. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Appointment Software

Name

• Appointment Booking Calendar Plugin

Version

• 1.3.0
• 1.3.1
• 1.3.2
• 1.3.3
• 1.3.4
• 1.3.5
• 1.3.6
• 1.3.7
• 1.3.8
• 1.3.9
• 1.3.10
• 1.3.11
• 1.3.12
• 1.3.13
• 1.3.14
• 1.3.15
• 1.3.16
• 1.3.17
• 1.3.18
• 1.3.19
• 1.3.20
• 1.3.21
• 1.3.22
• 1.3.23
• 1.3.24
• 1.3.25
• 1.3.26
• 1.3.27
• 1.3.28
• 1.3.29
• 1.3.30
• 1.3.31
• 1.3.32
• 1.3.33
• 1.3.34

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion