CVE-2023-0768 Avirato hotels online booking engine <= 5.0.5 - Subscriber+ SQLi
Authenticated users can perform SQL injection attacks via unvalidated shortcode attributes in the Avirato hotels online booking engine plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-0768?
CVE-2023-0768 is a high-severity SQL injection vulnerability in Unknown Avirato hotels online booking engine, published on 8 May 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Avirato hotels online booking engine WordPress plugin through 5.0.5 does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.
Which versions are affected by CVE-2023-0768?
It affects 1 product.
Products include Avirato Hotels Online Booking Engine.
How do I fix CVE-2023-0768?
No fix has been published for CVE-2023-0768 yet. Limit exposure of the affected software until one is available.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-0768 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-0768 exists.
Sources
Also known as GHSA-jj36-xcq2-26p9.