Low
CVE-2022-0739
CVE-2022-0739
Description
The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
Add Assessment
Technical Analysis
This is a trivial SQL injection and is very easy to exploit. The vulnerability lies in the bookingpress_front_get_category_services action in the BookingPress Wordpress Plugin. The vulnerable action accepts a parameter total_service which doesn’t properly sanitize input before passing it into a dynamically generated SQL query.
The vulnerability allows an unauthenticated attacker to instantly dump all the username and password hashes in the database. Anyone that can access the plugin page, also has access to all the creds in the database:
Wordpress User Credentials ========================== Username Email Hash -------- ----- ---- admin admin@admin.com $P$BfxUckldN6AiHPD0BK6jg58se2b.aL. hackerman hackerman@hacktheworld.io $P$BESfz7bqSOY8VkUfuYXAZ/bT5E36ww/ mr_metasploit mr_metasploit@metaslpoit.org $P$BDb8pIfym5dS6WTnNU8vU5Uk6i89fk. msfuser msfuser@rapid7.com $P$BpITVDPiqOZ7fyQbI5g9rsgUvZQFBd1 todd todd@toddtown.com $P$BnlpkVgxGFWnmvdDQ3JStgpIx8LMFj0
(the above output was generated from running the metasploit module against BookingPress v1.0.10)
With only a few thousand active installations I gave the Attacker Value a 2/5. Always be sure to keep your WordPress plugins up to date!
CVSS V3 Severity and Metrics
General Information
Vendors
- reputeinfosystems
Products
- bookingpress
Metasploit Modules
References
Exploit
A PoC added here by the AKB Worker must have at least 2 GitHub stars.
