CVE-2022-0834 Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName
Attackers can inject arbitrary web scripts via the lastName parameter in the Amelia WordPress plugin, executing code when users view the booking calendar.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-0834?
CVE-2022-0834 is a high-severity cross-site scripting vulnerability in ameliabooking Booking for Appointments and Events Calendar – Amelia, published on 23 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user accesses the booking calendar with the date the attacker has injected the malicious payload into. This affects versions up to and including 1.0.46.
Weakness: CWE-79
Which versions are affected by CVE-2022-0834?
It affects 1 product.
Products include Wpamelia Amelia.
How do I fix CVE-2022-0834?
No fix has been published for CVE-2022-0834 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-0834 being exploited?
There is no known exploitation of CVE-2022-0834 in the wild and no public exploit code.
Sources
Also known as GHSA-qcv2-jjq2-95wj.