CVE-2022-27862

Name of the Vulnerable Software and Affected Versions E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin version 1.5.3 and earlier

Description The issue allows for Arbitrary File Upload leading to Remote Code Execution (RCE) via the signature upload on the booking form, enabling attackers to upload and execute dangerous file types, such as PHP shells.

Recommendations For versions 1.5.3 and earlier, update to a version later than 1.5.3 to resolve the issue. As a temporary workaround, consider disabling the signature upload feature on the booking form until a patch is available. Restrict access to the booking form to minimize the risk of exploitation. Avoid using the vulnerable plugin until the issue is resolved.