CVE-2022-0739 PoC — BookingPress < 1.0.11 - Unauthenticated SQL Injection

Source

https://github.com/Manjen1218/CVE-2022-0739-Exploitation

Associated Vulnerability

Title: BookingPress < 1.0.11 - Unauthenticated SQL Injection (CVE-2022-0739)
Description:The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection

Readme

# CVE-2022-0739-Exploitation

An exploitation of CVE-2022-0739.  
  
It about BookingPress WordPress plugin before 1.0.11.  
By using bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection.  
Since the plugin fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →