CVE-2022-0694 Advanced Booking Calendar < 1.7.0 - Unauthenticated SQL Injection

What is CVE-2022-0694?

CVE-2022-0694 is a critical SQL injection vulnerability in Unknown Advanced Booking Calendar, published on 21 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection

Weakness: CWE-89

Which versions are affected by CVE-2022-0694?

It affects 1 product.

Products include Elbtide Advanced Booking Calendar.

How do I fix CVE-2022-0694?

No fix has been published for CVE-2022-0694 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2022-0694 being exploited?

There is no known exploitation of CVE-2022-0694 in the wild and no public exploit code.

Other vulnerabilities in Unknown Advanced Booking Calendar

• CVE-2022-45822 WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to SQL Injection Critical 10.0
• CVE-2022-1006 Advanced Booking Calendar < 1.7.1 - Admin+ SQLi High 7.2
• CVE-2022-1007 Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting Medium 6.1
• CVE-2022-45824 WordPress Advanced Booking Calendar Plugin <= 1.7.1 is vulnerable to Cross Site Request Forgery (CSRF) Medium 5.4
• CVE-2021-24232 Advanced Booking Calendar < 1.6.8 - Authenticated Reflected Cross-Site Scripting (XSS) Medium 5.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2j39-64q5-rjfv.