# Exploit Title: WordPress appointment-booking-calendar <=1.1.24 - Privilege escalation (Managing calendars) & Persistent XSS # Date: 2016-01-28 # Google Dork: Index of /wordpress/wp-content/plugins/appointment-booking-calendar/ # Exploit Author: Joaquin Ramirez Martinez [ i0 security-lab] # Software Link: http://wordpress.dwbooster.com/calendars/booking-calendar-contact-form # Vendor: CodePeople.net # Vebdor URI: http://codepeople.net # Version: 1.1.24 # Tested on: windows 10 + firefox + sqlmap 1.0. =================== PRODUCT DESCRIPTION =================== "Appointment Booking Calendar is a plugin for **accepting online bookings** from a set of **available time-slots in a calendar**. The booking form is linked to a **PayPal** payment process. You can use it to accept bookings for medical consultation, classrooms, events, transportation and other activities where a specific time from a defined set must be selected, allowing you to define the maximum number of bookings that can be accepted for each time-slot." (copy of readme file) ====================== EXPLOITATION TECHNIQUE ====================== remote ============== SEVERITY LEVEL ============== medium ================================ TECHNICAL DETAILS && DESCRIPTION ================================ Multiple privilege escalation were found in appointment-booking-calendar plugin that allows remote low level and unauthenticated users to update calendar owners and options (allowing persistent XSS). ================ PROOF OF CONCEPT ================ Changing all appointment tables with UTF-8 charset, injecting persistent XSS into ´ict´ and ´ics´ options and setting ´CPABC_APPOINTMENTS_LOAD_SCRIPTS´ option to value ´1´. Updating calendar with id 1 and setting name with persistent XSS (if the shortcode [CPABC_APPOINTMENT_CALENDAR calendar="1"] is added in a post, the injected XSS will appear, in administration page appear too). ========== CREDITS ========== Vulnerability discovered by: Joaquin Ramirez Martinez [i0 security-lab] joaquin.ramirez.mtz.lab[at]yandex[dot]com https://www.facebook.com/I0-security-lab-524954460988147/ https://www.youtube.com/user/strparser_lk ======== TIMELINE ======== 2016-01-08 vulnerability discovered 2016-01-24 reported to vendor