BookingPress Plugin up to 1.0.30 on WordPress appointment_id authorization

Summaryinfo

A vulnerability classified as problematic has been found in BookingPress Plugin up to 1.0.30 on WordPress. The affected element is an unknown function. The manipulation of the argument appointment_id leads to authorization. This vulnerability is listed as CVE-2022-4340. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in BookingPress Plugin up to 1.0.30 on WordPress (WordPress Plugin). It has been rated as problematic. This issue affects some unknown processing. The manipulation of the argument appointment_id with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. Impacted is confidentiality. The summary by CVE is:

The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visitor to display information about any booking, including full name, date, time and service booked, by manipulating the appointment_id query parameter.

The weakness was presented 01/03/2023. It is possible to read the advisory at wpscan.com. The identification of this vulnerability is CVE-2022-4340 since 12/07/2022. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 1.0.31 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Name

• BookingPress Plugin

Version

• 1.0.0
• 1.0.1
• 1.0.2
• 1.0.3
• 1.0.4
• 1.0.5
• 1.0.6
• 1.0.7
• 1.0.8
• 1.0.9
• 1.0.10
• 1.0.11
• 1.0.12
• 1.0.13
• 1.0.14
• 1.0.15
• 1.0.16
• 1.0.17
• 1.0.18
• 1.0.19
• 1.0.20
• 1.0.21
• 1.0.22
• 1.0.23
• 1.0.24
• 1.0.25
• 1.0.26
• 1.0.27
• 1.0.28
• 1.0.29
• 1.0.30

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion