# Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 – SQL Injection
\n# Date: 2022-04-11
\n# Exploit Author: Mohsen Dehghani (aka 0xProfessional)
\n# Vendor Homepage: https:\/\/motopress.com\/
\n# Software Link: https:\/\/downloads.wordpress.org\/plugin\/motopress-hotel-booking-lite.4.2.4.zip
\n# Version: 4.2.4
\n# Tested on: Windows\/XAMPP
\n###########################################################################
\nPoC:<\/p>\n
Vulnerable File:sync-urls-repository.php<\/p>\n
public function insertUrls($roomId, $urls)
\n{
\nglobal $wpdb;<\/p>\n
if (empty($urls)) {
\nreturn;
\n}<\/p>\n
$urls = $this->prepareUrls($urls);
\n$values = array();<\/p>\n
foreach ($urls as $syncId => $url) {
\n$values[] = $wpdb->prepare(“(%d, %s, %s)”, $roomId, $syncId, $url);
\n}<\/p>\n
$sql = “INSERT INTO {$this->tableName} (room_id, sync_id, calendar_url)”
\n. ” VALUES ” . implode(‘, ‘, $values);<\/p>\n
$wpdb->query($sql);<\/p>\n
Vulnerable Parameter:
\nroom_id=SQL Injection
\nsync_id=SQL Injection<\/p>\n","protected":false},"excerpt":{"rendered":"
# Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 – SQL Injection # Date: 2022-04-11 # Exploit Author: Mohsen Dehghani (aka 0xProfessional) # Vendor Homepage: https:\/\/motopress.com\/ # Software Link: https:\/\/downloads.wordpress.org\/plugin\/motopress-hotel-booking-lite.4.2.4.zip # Version: 4.2.4 # Tested on: Windows\/XAMPP ########################################################################### PoC: Vulnerable File:sync-urls-repository.php public function insertUrls($roomId, $urls) { global $wpdb; if (empty($urls)) { return; } $urls …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-23377","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/23377","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=23377"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/23377\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=23377"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=23377"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=23377"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}