SQL Injection in Amelia Booking Payments Sort and Package Coupon Filter

Skrevet den af i Amelia Booking

Two SQL injection sinks: the payments list builds its ORDER BY column from the request sort parameter with no allowlist, and the package-customer filter interpolates couponId straight into the WHERE clause. Fixed in 2.1.2.

This vulnerability affects the following application versions:

  • Amelia Booking 1.2.1
  • Amelia Booking 1.2.2
  • Amelia Booking 1.2.3
  • Amelia Booking 1.2.4
  • Amelia Booking 1.2.5
  • Amelia Booking 1.2.6
  • Amelia Booking 1.2.7
  • Amelia Booking 1.2.8
  • Amelia Booking 1.2.9
  • Amelia Booking 1.2.10
  • Amelia Booking 1.2.11
  • Amelia Booking 1.2.12
  • Amelia Booking 1.2.13
  • Amelia Booking 1.2.14
  • Amelia Booking 1.2.15
  • Amelia Booking 1.2.16
  • Amelia Booking 1.2.17
  • Amelia Booking 1.2.18
  • Amelia Booking 1.2.19
  • Amelia Booking 1.2.20
  • Amelia Booking 1.2.21
  • Amelia Booking 1.2.22
  • Amelia Booking 1.2.23
  • Amelia Booking 1.2.24
  • Amelia Booking 1.2.25
  • Amelia Booking 1.2.26
  • Amelia Booking 1.2.27
  • Amelia Booking 1.2.28
  • Amelia Booking 1.2.29
  • Amelia Booking 1.2.30
  • Amelia Booking 1.2.31
  • Amelia Booking 1.2.32
  • Amelia Booking 1.2.33
  • Amelia Booking 1.2.34
  • Amelia Booking 1.2.35
  • Amelia Booking 1.2.36
  • Amelia Booking 1.2.37
  • Amelia Booking 1.2.38
  • Amelia Booking 2.0
  • Amelia Booking 2.0.1
  • Amelia Booking 2.0.2
  • Amelia Booking 2.1
  • Amelia Booking 2.1.1