Cross-Site Request Forgery Leads to RCE in Salon Booking System

Executive Summary

The Salon Booking System – Free Version plugin for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability in all versions up to and including 10.30.32. This occurs because the plugin lacks proper nonce validation on the setCustomText function. As a result, an unauthenticated attacker can trick a site administrator into performing an action, such as clicking a malicious link, which allows the attacker to inject arbitrary PHP code into the translate-constants.php file within the plugin directory.

Although the plugin applies sanitize_text_field() to the POST 'value' parameter, this function does not neutralize certain characters (like single quotes, parentheses, semicolons, $, and square brackets) that are necessary to break out of the PHP string literal. This enables the attacker to execute remote code on the server by writing malicious PHP code to disk.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including remote code execution on the server hosting the WordPress site. An attacker who successfully exploits this flaw can run arbitrary PHP code, potentially leading to full server compromise.

• Unauthorized access to sensitive data.
• Modification or deletion of website content or data.
• Installation of backdoors or malware.
• Disruption of website availability or functionality.

Useful 0 Not Useful 0