SQL Injection Vulnerability in WP Hotel Booking Plugin
CVE-2024-3605
Key Information:
- Vendor
- Wordpress
- Status
- Vendor
- CVE Published:
- 20 June 2024
Badges
Summary
The WP Hotel Booking plugin for WordPress is susceptible to SQL Injection attacks via the 'room_type' parameter in the /wphb/v1/rooms/search-rooms REST API endpoint. This vulnerability arises from inadequate escaping of user-supplied data and insufficient preparation of the SQL query. As a result, unauthenticated attackers can inject additional SQL commands, potentially leading to the extraction of sensitive information from the underlying database. This presents a significant security risk for users of the plugin across all versions up to and including 2.1.0.
Affected Version(s)
WP Hotel Booking * <= 2.1.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- ๐ก
Public PoC available
- ๐พ
Exploit known to exist
Vulnerability published
Vulnerability Reserved