CVE-2024-1207 — AI Deep Analysis Summary

🚨 **Essence**: Unauthenticated SQL Injection in WP Booking Calendar. 💥 **Consequences**: Attackers can manipulate database queries, leading to data theft, modification, or deletion.…

🛡️ **CWE-89**: SQL Injection. 🔍 **Flaw**: Insufficient escaping of user-supplied parameters (`calendar_request_params[dates_ddmmyy_csv]`) before SQL concatenation. Lack of prepared statements.

📦 **Vendor**: wpdevelop. 📉 **Product**: Booking Calendar. 📅 **Versions**: 9.9 and earlier. 🌐 **Platform**: WordPress Plugin.

🕵️ **Privileges**: Unauthenticated access required. 🗄️ **Data**: Full database read/write access. 📜 **Impact**: High Confidentiality, Integrity, and Availability impact (CVSS H).

📉 **Threshold**: LOW. 🚪 **Auth**: None required (Unauthenticated). ⚙️ **Config**: Standard WordPress AJAX endpoint (`admin-ajax.php`). Easy to trigger via POST requests.

🔓 **Exploit**: YES. 📂 **PoC**: Publicly available on GitHub (sahar042/CVE-2024-1207). 🌍 **Wild Exploitation**: High risk due to simplicity and lack of auth requirement.

🔍 **Check**: Scan for `admin-ajax.php` with `action=WPBC_AJX_BOOKING__CREATE`. 📡 **Indicator**: Look for SQL errors or unexpected data in responses when injecting payloads into `dates_ddmmyy_csv`.

🛠️ **Fix**: Update to version > 9.9. 📝 **Patch**: Developer released fix in changeset 3032596. ✅ **Status**: Official mitigation available via plugin update.

🚧 **Workaround**: If unpatched, restrict access to `admin-ajax.php` via WAF rules. 🚫 **Block**: Filter malicious payloads in `dates_ddmmyy_csv` parameter. 🛑 **Disable**: Temporarily disable the plugin if not critical.

🔥 **Priority**: CRITICAL. ⏱️ **Urgency**: Immediate action required. 📢 **Reason**: Unauthenticated, high impact, and public PoC exist. Patch immediately to prevent data breach.