{"id":"CVE-2022-1006","state":"PUBLISHED","title":"Advanced Booking Calendar < 1.7.1 - Admin+ SQLi","description":"The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks","publishedAt":"2022-04-11T14:41:04.000Z","updatedAt":"2024-08-02T23:47:42.797Z","severity":null,"assigner":"WPScan","products":["Unknown Advanced Booking Calendar"],"affected":[{"vendor":"Unknown","product":"Advanced Booking Calendar","versions":[{"version":"1.7.1","status":"affected","lessThan":"1.7.1","versionType":"custom"}]}],"references":["https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68","https://plugins.trac.wordpress.org/changeset/2695427"],"weaknesses":["CWE-89"],"ingestedAt":"2026-10-29T19:49:29.138Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2022/1xxx/CVE-2022-1006.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2022-1006","state":"PUBLISHED","datePublished":"2022-04-11T14:41:04.000Z","dateUpdated":"2024-08-02T23:47:42.797Z","assignerShortName":"WPScan","assignerOrgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81","dateReserved":"2022-03-17T00:00:00.000Z"},"containers":{"cna":{"title":"Advanced Booking Calendar < 1.7.1 - Admin+ SQLi","descriptions":[{"lang":"en","value":"The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks"}],"affected":[{"vendor":"Unknown","product":"Advanced Booking Calendar","versions":[{"version":"1.7.1","status":"affected","lessThan":"1.7.1","versionType":"custom"}]}],"references":[{"url":"https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68","tags":["x_refsource_MISC"]},{"url":"https://plugins.trac.wordpress.org/changeset/2695427","tags":["x_refsource_CONFIRM"]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-89","description":"CWE-89 SQL Injection","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"WPScan","dateUpdated":"2022-04-11T14:41:04.000Z","orgId":"1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81"},"credits":[{"lang":"en","value":"YICHENG LIU-ZTE CHENFENG lab"}],"source":{"discovery":"EXTERNAL"},"x_generator":"WPScan CVE Generator","x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"contact@wpscan.com","ID":"CVE-2022-1006","STATE":"PUBLIC","TITLE":"Advanced Booking Calendar < 1.7.1 - Admin+ SQLi"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Advanced Booking Calendar","version":{"version_data":[{"version_affected":"<","version_name":"1.7.1","version_value":"1.7.1"}]}}]},"vendor_name":"Unknown"}]}},"credit":[{"lang":"eng","value":"YICHENG LIU-ZTE CHENFENG lab"}],"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks"}]},"generator":"WPScan CVE Generator","problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-89 SQL Injection"}]}]},"references":{"reference_data":[{"name":"https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68","refsource":"MISC","url":"https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68"},{"name":"https://plugins.trac.wordpress.org/changeset/2695427","refsource":"CONFIRM","url":"https://plugins.trac.wordpress.org/changeset/2695427"}]},"source":{"discovery":"EXTERNAL"}}},"adp":[{"title":"CVE Program Container","references":[{"url":"https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68","tags":["x_refsource_MISC","x_transferred"]},{"url":"https://plugins.trac.wordpress.org/changeset/2695427","tags":["x_refsource_CONFIRM","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T23:47:42.797Z"}}]}}}