Two SQL injection sinks: the payments list builds its ORDER BY column from the request sort parameter with no allowlist, and the package-customer filter interpolates couponId straight into the WHERE clause. Fixed in 2.1.2.
This vulnerability affects the following application versions:
- Amelia Booking 1.2.1
- Amelia Booking 1.2.2
- Amelia Booking 1.2.3
- Amelia Booking 1.2.4
- Amelia Booking 1.2.5
- Amelia Booking 1.2.6
- Amelia Booking 1.2.7
- Amelia Booking 1.2.8
- Amelia Booking 1.2.9
- Amelia Booking 1.2.10
- Amelia Booking 1.2.11
- Amelia Booking 1.2.12
- Amelia Booking 1.2.13
- Amelia Booking 1.2.14
- Amelia Booking 1.2.15
- Amelia Booking 1.2.16
- Amelia Booking 1.2.17
- Amelia Booking 1.2.18
- Amelia Booking 1.2.19
- Amelia Booking 1.2.20
- Amelia Booking 1.2.21
- Amelia Booking 1.2.22
- Amelia Booking 1.2.23
- Amelia Booking 1.2.24
- Amelia Booking 1.2.25
- Amelia Booking 1.2.26
- Amelia Booking 1.2.27
- Amelia Booking 1.2.28
- Amelia Booking 1.2.29
- Amelia Booking 1.2.30
- Amelia Booking 1.2.31
- Amelia Booking 1.2.32
- Amelia Booking 1.2.33
- Amelia Booking 1.2.34
- Amelia Booking 1.2.35
- Amelia Booking 1.2.36
- Amelia Booking 1.2.37
- Amelia Booking 1.2.38
- Amelia Booking 2.0
- Amelia Booking 2.0.1
- Amelia Booking 2.0.2
- Amelia Booking 2.1
- Amelia Booking 2.1.1