Bookgy SQL Injection Vulnerability Allowing Database Manipulation

A SQL injection vulnerability has been identified in Bookgy, an online booking and management software. This vulnerability allows attackers to retrieve, create, update, and delete databases by sending HTTP requests through the 'IDTIPO', 'IDPISTA', and 'IDSOCIO' parameters in the '/bkg_seleccionar_hora_ajax.php' file.

Impact

Exploitation of this vulnerability could lead to unauthorized database access and manipulation, allowing attackers to alter or delete critical data.

Remediation

This vulnerability has been fixed by the Bookgy team in October 2024 and is no longer exploitable.