CVE-2022-1952
Published: 11 July 2022
Summary
CVE-2022-1952 is a critical-severity Unrestricted Upload of File with Dangerous Type (CWE-434) vulnerability in Syntacticsinc Easync. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The Free Booking Plugin for Hotels, Restaurant and Car Rental for WordPress, versions prior to 1.1.16, contains an unrestricted file upload vulnerability (CWE-434) caused by insufficient input validation on an AJAX action. Although the plugin defines an allowlist of permitted file extensions, the list is never consulted during processing, allowing unauthenticated attackers to upload arbitrary files including executable code.
An unauthenticated remote attacker can invoke the affected AJAX endpoint to upload a malicious file and subsequently execute it on the server, resulting in full remote code execution with the privileges of the web server process. The flaw carries a CVSS 3.1 score of 9.8, reflecting network attack vector, low complexity, and no required authentication or user interaction.
Public references from WPScan document the issue and identify the fixed version 1.1.16. The associated EPSS score has reached a peak of 0.8983 with a current value of 0.8590, indicating sustained exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-25220
Vulnerability details
The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected…
more
by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Requiring identifiable owners for portable devices reduces the attack surface for unrestricted uploads of dangerous file types via anonymous media.
Dangerous file uploads can be detonated in the chamber to determine malice before any production write or execution occurs.
Prevents unrestricted writing of arbitrary or malicious firmware by keeping hardware write-protect enabled except under tightly controlled manual procedures.
Scans files from external sources on download/open/execute, blocking unrestricted uploads of dangerous file types.