CVE-2023-0220 Pinpoint Booking System < 2.9.9.2.9 - Subscriber+ SQLi
Authenticated users can perform SQL injection via unvalidated shortcode attributes in the Pinpoint Booking System WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0220?
CVE-2023-0220 is a high-severity SQL injection vulnerability in Unknown Pinpoint Booking System, published on 13 Feb 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.
Which versions are affected by CVE-2023-0220?
It affects 1 product.
Products include Pinpoint Pinpoint Booking System.
How do I fix CVE-2023-0220?
No fix has been published for CVE-2023-0220 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-0220 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0220 exists.
Other vulnerabilities in Unknown Pinpoint Booking System
- CVE-2024-7112 Pinpoint Booking System <= 2.9.9.5.0- Authenticated (Subscriber+) SQL Injection
- CVE-2015-9460 SQL injection in n/a
- CVE-2024-13235 Pinpoint Booking System – #1 WordPress Booking Plugin <= 2.9.9.5.4 - Authenticated (Subscriber+) SQL Injection
- CVE-2023-25062 WordPress Pinpoint Booking System Plugin <= 2.9.9.2.8 is vulnerable to Cross Site Scripting (XSS)
- CVE-2024-3636 Pinpoint Booking System < 2.9.9.4.8 - Admin+ Stored XSS
Sources
Also known as GHSA-3wg8-6w7g-gg2j.