WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - SQL Injection

vendor:

Motopress Hotel Booking Lite

by:

Mohsen Dehghani (aka 0xProfessional)

9.8

CVSS

CRITICAL

SQL Injection

CWE

Product Name: Motopress Hotel Booking Lite

Affected Version From: 4.2.2004

Affected Version To: 4.2.2004

Patch Exists: NO

Related CWE:

CPE: a:motopress:motopress_hotel_booking_lite:4.2.4

Metasploit:

Other Scripts:

Platforms Tested: Windows/XAMPP

2022

WordPress Plugin Motopress Hotel Booking Lite 4.2.4 – SQL Injection

The WordPress Plugin Motopress Hotel Booking Lite version 4.2.4 is vulnerable to SQL Injection. The vulnerability exists in the sync-urls-repository.php file, where the room_id, sync_id, and calendar_url parameters are vulnerable to SQL injection.

Mitigation:

Developers should ensure that user-supplied input is properly sanitized and validated before being used in SQL queries.

Source

Exploit-DB raw data:

# Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - SQL Injection
# Date: 2022-04-11
# Exploit Author: Mohsen Dehghani (aka 0xProfessional)
# Vendor Homepage: https://motopress.com/
# Software Link: https://downloads.wordpress.org/plugin/motopress-hotel-booking-lite.4.2.4.zip
# Version: 4.2.4
# Tested on: Windows/XAMPP
###########################################################################
PoC:

Vulnerable File:sync-urls-repository.php

    public function insertUrls($roomId, $urls)
    {
        global $wpdb;

        if (empty($urls)) {
            return;
        }

        $urls = $this->prepareUrls($urls);
        $values = array();

        foreach ($urls as $syncId => $url) {
            $values[] = $wpdb->prepare("(%d, %s, %s)", $roomId, $syncId, $url);
        }

        $sql = "INSERT INTO {$this->tableName} (room_id, sync_id, calendar_url)"
            . " VALUES " . implode(', ', $values);

        $wpdb->query($sql);

Vulnerable Parameter:
room_id=SQL Injection
sync_id=SQL Injection