2 lines
4.5 KiB
JSON
2 lines
4.5 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin","vendor":"croixhaug","versions":[{"lessThanOrEqual":"1.6.9.27","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to blind SQL Injection in all versions up to, and including, 1.6.9.27. This is due to the `db_where_conditions` method in the `TD_DB_Model` class failing to prevent the `append_where_sql` parameter from being passed through JSON request bodies, while only checking for its presence in the `$_REQUEST` superglobal. This makes it possible for unauthenticated attackers to append arbitrary SQL commands to queries and extract sensitive information from the database via the `append_where_sql` parameter in JSON payloads granted they have obtained a valid `public_token` that is inadvertently exposed during the booking flow."},{"lang":"es","value":"El plugin Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin para WordPress es vulnerable a inyección SQL ciega en todas las versiones hasta, e incluyendo, la 1.6.9.27. Esto se debe a que el método 'db_where_conditions' en la clase 'TD_DB_Model' no evita que el parámetro 'append_where_sql' se pase a través de los cuerpos de las solicitudes JSON, mientras que solo verifica su presencia en la superglobal '$_REQUEST'. Esto hace posible que atacantes no autenticados añadan comandos SQL arbitrarios a las consultas y extraigan información sensible de la base de datos a través del parámetro 'append_where_sql' en las cargas útiles JSON, siempre que hayan obtenido un 'public_token' válido que se expone inadvertidamente durante el flujo de reserva."}],"id":"CVE-2026-1708","lastModified":"2026-06-17T10:16:22.240","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.5,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":3.9,"impactScore":3.6,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-1708","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-03-11T13:50:25.957126Z","version":"2.0.3"}}]},"published":"2026-03-11T08:16:03.150","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-appointment-model.php#L1340"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/class-appointment-model.php#L1413"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/lib/td-util/class-td-db-model.php#L1019"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/tags/1.6.9.21/includes/lib/td-util/class-td-db-model.php#L1025"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-model.php#L1340"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/class-appointment-model.php#L1413"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/lib/td-util/class-td-db-model.php#L1019"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/simply-schedule-appointments/trunk/includes/lib/td-util/class-td-db-model.php#L1025"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3475885/simply-schedule-appointments/trunk/includes/lib/td-util/class-td-db-model.php"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/71642341-9fe0-44a9-88f3-70167dc6ca62?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-89"}],"source":"security@wordfence.com","type":"Secondary"}]}
|