CVE-2022-1409: VikBooking Hotel Booking Engine & PMS < 1.5.8 - Admin+ PHP File Upload
Published May 16, 2022
·Updated
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code
Affected Software
1 affected component
vikwp Hotel Booking Engine \& Pms Wordpress<1.5.8
Event History
May 16, 2022
CVE Published
via MITRE·02:30 PM
Data Sourced
via MITRE·02:30 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2022-1409.
2
What is the severity of CVE-2022-1409?
The severity of CVE-2022-1409 is high.
3
What is the affected software of CVE-2022-1409?
The affected software of CVE-2022-1409 is the VikBooking Hotel Booking Engine & PMS WordPress plugin version up to 1.5.8.
4
What is the risk of CVE-2022-1409?
The risk of CVE-2022-1409 is the ability for high privilege users to upload PHP files disguised as images and containing malicious PHP code.
5
How can CVE-2022-1409 be exploited?
CVE-2022-1409 can be exploited by high privilege users uploading PHP files disguised as images.