CVE-2022-0739 PoC — BookingPress < 1.0.11 - Unauthenticated SQL Injection

Source

https://github.com/lhamouche/Bash-exploit-for-CVE-2022-0739

Associated Vulnerability

Title:BookingPress < 1.0.11 - Unauthenticated SQL Injection (CVE-2022-0739)
Description:The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection

Readme

# Bash exploit for CVE-2022-0739

Unauthenticated SQL Injection for BookingPress < 1.0.11.

```
Usage: ./exploit.sh [options]

Options:
    -u, --url VALUE         Set the URL (ex: http://example.com) (required)
    -e, --event-dir VALUE   Set the event directory (ex: events)
    -h, --help              Display this help message
```

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →