CVE-2022-0834

Amelia <= 1.0.46 - Stored Cross Site Scripting via lastName

CVSS 7.2 HIGHEPSS 0.5%CWE-79

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7.2EPSS 0.5%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

23 Mar 2022Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

The Amelia WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the lastName parameter found in the ~/src/Application/Controller/User/Customer/AddCustomerController.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user accesses the booking calendar with the date the attacker has injected the malicious payload into. This affects versions up to and including 1.0.46.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Affected products

ameliabooking · Booking for Appointments and Events Calendar – Amelia

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/73f12f22-c0a4-4010-9634-ce7308254028?source=cve https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0834