Attacker Value
Low
(1 user assessed)
Exploitability
Very High
(1 user assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
1

CVE-2022-0739

Disclosure Date: March 21, 2022
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection

Add Assessment

2
Ratings
  • Attacker Value
    Low
  • Exploitability
    Very High
Technical Analysis

This is a trivial SQL injection and is very easy to exploit. The vulnerability lies in the bookingpress_front_get_category_services action in the BookingPress Wordpress Plugin. The vulnerable action accepts a parameter total_service which doesn’t properly sanitize input before passing it into a dynamically generated SQL query.

The vulnerability allows an unauthenticated attacker to instantly dump all the username and password hashes in the database. Anyone that can access the plugin page, also has access to all the creds in the database:

Wordpress User Credentials
==========================

 Username       Email                         Hash
 --------       -----                         ----
 admin          admin@admin.com               $P$BfxUckldN6AiHPD0BK6jg58se2b.aL.
 hackerman      hackerman@hacktheworld.io     $P$BESfz7bqSOY8VkUfuYXAZ/bT5E36ww/
 mr_metasploit  mr_metasploit@metaslpoit.org  $P$BDb8pIfym5dS6WTnNU8vU5Uk6i89fk.
 msfuser        msfuser@rapid7.com            $P$BpITVDPiqOZ7fyQbI5g9rsgUvZQFBd1
 todd           todd@toddtown.com             $P$BnlpkVgxGFWnmvdDQ3JStgpIx8LMFj0

(the above output was generated from running the metasploit module against BookingPress v1.0.10)

With only a few thousand active installations I gave the Attacker Value a 2/5. Always be sure to keep your WordPress plugins up to date!

CVSS V3 Severity and Metrics
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • reputeinfosystems

Products

  • bookingpress

References

Exploit
PoCs that have not been added by contributors directly have been sourced from: nomi-sec/PoC-in-GitHub.
A PoC added here by the AKB Worker must have at least 2 GitHub stars.

Additional Info

Technical Analysis