Executive Summary

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress is vulnerable to a blind SQL Injection in all versions up to and including 1.6.9.27.

This vulnerability arises because the method `db_where_conditions` in the `TD_DB_Model` class does not properly prevent the `append_where_sql` parameter from being passed through JSON request bodies. It only checks for this parameter in the `$_REQUEST` superglobal, missing the JSON payloads.

As a result, an unauthenticated attacker who has obtained a valid `public_token` (which is inadvertently exposed during the booking flow) can append arbitrary SQL commands to database queries via the `append_where_sql` parameter in JSON payloads, allowing them to extract sensitive information from the database.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to perform blind SQL Injection attacks on the plugin's database.

The impact includes the potential extraction of sensitive information from the database without authorization.

Because the attacker can append arbitrary SQL commands, they may be able to access confidential data stored by the plugin, which could lead to data breaches or exposure of private user information.

The CVSS v3.1 base score of 7.5 indicates a high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': 'The vulnerability involves the `append_where_sql` parameter being passed through JSON request bodies, which can be exploited by unauthenticated attackers who have obtained a valid `public_token`. Detection would involve monitoring for unusual or unauthorized JSON payloads containing the `append_where_sql` parameter in requests to the Appointment Booking Calendar plugin endpoints.'}, {'type': 'paragraph', 'content': 'Since the vulnerability is a blind SQL injection via JSON payloads, detection can include inspecting HTTP request bodies for the presence of the `append_where_sql` parameter in JSON data, especially if accompanied by a `public_token`.'}, {'type': 'paragraph', 'content': 'Suggested commands to detect such activity could include using network traffic inspection tools or command-line utilities like curl or tcpdump combined with grep or jq to filter for suspicious JSON requests.'}, {'type': 'list_item', 'content': 'Use tcpdump or Wireshark to capture HTTP POST requests to the WordPress site and filter for JSON bodies containing "append_where_sql".'}, {'type': 'list_item', 'content': "Example tcpdump command: tcpdump -A -s 0 'tcp port 80 or tcp port 443' | grep -i 'append_where_sql'"}, {'type': 'list_item', 'content': 'Use curl to replay or test endpoints with crafted JSON payloads containing the `append_where_sql` parameter to verify if the server processes them.'}, {'type': 'list_item', 'content': 'Example curl command to test: curl -X POST -H "Content-Type: application/json" -d \'{"append_where_sql":"1=1"}\' https://yourwordpresssite.com/wp-json/endpoint'}] [5]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin to version 1.6.9.29 or later, where the vulnerability has been addressed by adding validation to prevent SQL injection via the `append_where_sql` parameter.

The update ensures that the `append_where_sql` parameter is not accepted from user-controllable inputs such as JSON request bodies, $_REQUEST, or $_FILES, effectively blocking unauthenticated attackers from injecting arbitrary SQL.

If immediate updating is not possible, consider temporarily disabling the plugin or restricting access to the booking endpoints to trusted IP addresses to prevent exploitation.

Additionally, monitor logs for suspicious requests containing the `append_where_sql` parameter and revoke or rotate any exposed `public_token` values if possible.

Useful 0 Not Useful 0