Description
Course Booking System是WordPress生态中一款课程预约管理插件，提供课程创建、学员注册、预约管理、支付集成等核心功能，广泛应用于教育培训机构、在线课程平台等场景。该插件的 /wp-admin/admin-ajax.php 接口存在SQL注入漏洞，攻击者可利用此漏洞获取数据库敏感信息。
WordPress Course Booking System /wp-admin/admin-ajax.php cbs_action_booking_delete SQL 注入漏洞（CVE-2025-22785）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-22785
https://github.com/RandomRobbieBF/CVE-2025-22785
https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/course-booking-system/course-booking-system-605-unauthenticated-sql-injection
https://www.cve.org/CVERecord?id=CVE-2025-22785
https://patchstack.com/database/wordpress/plugin/course-booking-system/vulnerability/wordpress-course-booking-system-plugin-6-0-5-sql-injection-vulnerability
https://wpscan.com/vulnerability/e78aded0-5f4e-4648-828b-a1d391ad3f53/
https://vulntitan.com/vulnerabilities/17538
https://app.opencve.io/cve/CVE-2025-22785