Reflected XSS in VikBooking Hotel Booking Engine & PMS for WordPress

Executive Summary

The VikBooking Hotel Booking Engine & PMS plugin for WordPress has a Reflected Cross-Site Scripting (XSS) vulnerability in the 'layoutstyle' parameter. This vulnerability exists in all versions up to and including 1.8.12 because the plugin does not properly sanitize input or escape output for this parameter.

An unauthenticated attacker can exploit this by injecting malicious web scripts into pages that use the [vikbooking view="roomslist"] shortcode, where the 'layoutstyle' parameter is processed. If a user is tricked into clicking a crafted link, the injected script executes in their browser.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute arbitrary scripts in the context of the affected website when a user interacts with a maliciously crafted link. This can lead to theft of user credentials, session hijacking, defacement, or other malicious actions performed on behalf of the user.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the 'layoutstyle' parameter in the VikBooking plugin's roomslist view shortcode being vulnerable to reflected Cross-Site Scripting (XSS). Detection involves identifying if your WordPress site uses the VikBooking Hotel Booking Engine & PMS plugin version 1.8.12 or earlier and if the vulnerable shortcode [vikbooking view="roomslist"] is rendered.

To detect attempts to exploit this vulnerability on your network or system, you can monitor HTTP requests for suspicious input in the 'layoutstyle' parameter, especially those containing script tags or encoded JavaScript.

• Use web server logs or a network monitoring tool to search for requests with 'layoutstyle' parameters containing suspicious payloads, e.g., grep 'layoutstyle' access.log | grep -i '<script>'
• Use curl or similar tools to test the parameter manually, for example: curl -G 'http://yourwordpresssite.com/page?layoutstyle=<script>alert(1)</script>' and observe if the script executes or is reflected in the response.
• Employ security scanners or web application firewalls (WAFs) that can detect reflected XSS patterns targeting the 'layoutstyle' parameter.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the VikBooking Hotel Booking Engine & PMS plugin to a version later than 1.8.12 where this vulnerability is fixed.

If an update is not immediately possible, consider disabling or removing the use of the [vikbooking view="roomslist"] shortcode on your site to prevent the vulnerable parameter from being processed.

Implement Web Application Firewall (WAF) rules to block or sanitize requests containing malicious input in the 'layoutstyle' parameter.

Educate users to avoid clicking on suspicious links that could exploit this reflected XSS vulnerability.

Useful 0 Not Useful 0