Cyber Resilience

CVE-2022-0658

CriticalPublic PoC

Published: 14 March 2022

Published
14 March 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.4725 97.8th percentile
Risk Priority 48 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-0658 is a critical-severity SQL Injection (CWE-89) vulnerability in Wielebenwir Commonsbooking. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 2.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Deeper analysis

The vulnerability is an unauthenticated SQL injection (CWE-89) affecting the CommonsBooking WordPress plugin before version 2.6.8. It arises because the plugin fails to sanitize or escape the location parameter supplied to the calendar_data AJAX action before incorporating it into dynamically built SQL queries.

Unauthenticated remote attackers can exploit the flaw over the network without any user interaction. Successful exploitation grants full read/write access and the ability to disrupt the application, consistent with the CVSS 3.1 score of 9.8.

Public references on WPScan describe the affected endpoint and advise updating the plugin to version 2.6.8 or later to eliminate the injection vector. The associated EPSS score has remained flat at its recorded peak of 0.4725.

EU & UK References

Vulnerability details

The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

wielebenwir
commonsbooking
≤ 2.6.8

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-89

Penetration testing uses SQL injection payloads against database interfaces, identifying and supporting fixes for SQL injection weaknesses.

addresses: CWE-89

Validates query inputs to prevent SQL syntax or command manipulation.

References