cve/2022/CVE-2022-1409.md

### [CVE-2022-1409](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1409)
![](https://img.shields.io/static/v1?label=Product&message=VikBooking%20Hotel%20Booking%20Engine%20%26%20PMS&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.5.8%3C%201.5.8%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-434%20Unrestricted%20Upload%20of%20File%20with%20Dangerous%20Type&color=brighgreen)

### Description

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code

### POC

#### Reference
- https://wpscan.com/vulnerability/1330f8f7-4a59-4e9d-acae-21656a4101fe

#### Github
No PoCs found on GitHub currently.