Description
The Booking Manager WordPress plugin before 2.1.21 does not sanitize and escape values taken from a fetched external iCalendar feed before using them in a SQL query, allowing authenticated users with Author-level access and above to perform SQL injection attacks by importing a feed they control.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Booking Manager | < 2.1.21 | 2.1.21 |
References
- https://wpscan.com/vulnerability/a5472152-0b96-4fc6-af90-2f1b01811237/ exploit vdb-entry technical-description