CVE-2022-0739
Published: 21 March 2022
Summary
CVE-2022-0739 is a critical-severity SQL Injection (CWE-89) vulnerability in Reputeinfosystems Bookingpress. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 1.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The BookingPress WordPress plugin before version 1.0.11 is affected by an unauthenticated SQL injection vulnerability (CWE-89) with a CVSS 3.1 score of 9.8. The root cause is missing sanitization of user-supplied POST data that is concatenated into a dynamically built SQL query inside the bookingpress_front_get_category_services AJAX action, which is reachable without authentication.
An attacker can send crafted POST requests to the AJAX endpoint to inject arbitrary SQL, enabling extraction, modification, or deletion of database contents and potentially leading to full site compromise. No authentication, user interaction, or special network conditions are required for exploitation.
The linked WordPress plugin changeset and WPScan advisory document the fix that was applied in version 1.0.11. The EPSS score has remained high, reaching a peak of 0.7311 with a current value of 0.6993.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-15806
Vulnerability details
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.