// For flags

CVE-2015-7235

CP Reservation Calendar < 1.1.7 - SQL Injection

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Multiple SQL injection vulnerabilities in dex_reservations.php in the CP Reservation Calendar plugin before 1.1.7 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) id parameter in a dex_reservations_calendar_load2 action or (2) dex_item parameter in a dex_reservations_check_posted_data action in a request to the default URI.

Múltiples vulnerabilidades de inyección SQL en dex_reservations.php en el plugin CP Reservation Calendar en versiones anteriores a 1.1.7 para WordPress, permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro (1) id en una acción dex_reservations_calendar_load2 o (2) dex_item en una acción dex_reservations_check_posted_data en una petición a una URI por defecto.

*Credits: Christian Mondrago,Uriel Zarate
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2015-09-15 CVE Published
  • 2015-09-17 CVE Reserved
  • 2024-08-06 CVE Updated
  • 2024-08-06 First Exploit
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Cp Reservation Calender Project
Search vendor "Cp Reservation Calender Project"
 Cp Reservation Calender
Search vendor "Cp Reservation Calender Project" for product "Cp Reservation Calender"
 <= 1.1.6
Search vendor "Cp Reservation Calender Project" for product "Cp Reservation Calender" and version " <= 1.1.6"
wordpress
Affected