SQL Injection Vulnerability in Tourfic WordPress Plugin for Hotel Booking

CVE-2024-12032

Summary

The Ultimate Hotel Booking, Travel Booking & Apartment Booking WordPress Plugin, specifically the WooCommerce Booking variant, is susceptible to SQL Injection through the 'enquiry_id' parameter within the 'tf_enquiry_reply_email_callback' function. This vulnerability arises from inadequate escaping of user input and insufficient preparation in the SQL query, allowing attackers with Subscriber-level or higher access to inject their own SQL commands. As a result, they can potentially append additional queries to the original SQL command, leading to unauthorized access to sensitive information stored in the database. This poses a serious risk and highlights the need for secure coding practices and proper validation of user inputs in web applications.

References