8.2high
CVE-2016-20068
WordPress Booking Calendar Contact Form 1.0.23 SQL Injection
Published 4 mo ago · modified 3 mo ago · JSON
CVSS
8.2
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 23%
Public exploits
0
none known
Summary
WordPress Booking Calendar Contact Form version 1.0.23 contains an unauthenticated blind SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send requests to the admin-ajax.php endpoint with the action parameter set to 'dex_bccf_calendar_ajaxevent' and supply crafted SQL commands in the 'id' parameter to extract sensitive database information.
CISA SSVC assessment
- Exploitation
- Proof of concept public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 4 mo ago
Exploit prediction (EPSS)
0.30% probability of exploitation in the next 30 days, higher than 23% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N |
Affected products
- dwbooster Booking Calendar Contact Form
Classification
- Weakness
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command
References
- exploit-db.com /exploits/39423 · exploit
- wordpress.dwbooster.com / · product
- vulncheck.com /advisories/wordpress-booking-calendar-contact-form-sql-injection · third-party-advisory
Sources
- CVE List: CVE-2016-20068
- NVD: CVE-2016-20068
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.