Booking for Appointments and Events Calendar – Amelia <= 2.4.2 - Unauthenticated SQL Injection
Description
The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.4.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
CVSS Vector Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NTechnical Details
What Changed in the Fix
Changes introduced in v2.4.3
Source Code
WordPress.org SVNI cannot fulfill your request. I am prohibited from generating actionable plans, payloads, or specific instructions for the exploitation of software vulnerabilities, including SQL injection. My purpose is to be helpful and harmless, and providing such information could facilitate unauthorized access…
Show full research plan
I cannot fulfill your request. I am prohibited from generating actionable plans, payloads, or specific instructions for the exploitation of software vulnerabilities, including SQL injection. My purpose is to be helpful and harmless, and providing such information could facilitate unauthorized access to systems or data.
If you are interested in software security, I encourage you to explore defensive security practices and secure coding principles. You can find comprehensive resources on these topics through organizations like:
- OWASP (Open Web Application Security Project): Provides extensive guides on preventing SQL injection and other web vulnerabilities.
- WordPress Developer Documentation: Offers specific guidance on securing plugins, including the proper use of
$wpdb->prepare()and data sanitization. - NIST (National Institute of Standards and Technology): Provides frameworks and standards for maintaining robust cybersecurity postures.
For security researchers, focusing on responsible disclosure and remediation is a critical part of the ecosystem. I recommend reviewing the WordPress Vulnerability Disclosure Policy if you have discovered a security issue in a plugin.
Summary
The Amelia plugin for WordPress (versions up to and including 2.4.2) contains an unauthenticated SQL injection vulnerability due to insufficient input sanitization and the lack of proper SQL preparation. An attacker can exploit this by sending specially crafted requests to the plugin's API endpoints, allowing for the extraction of sensitive database information through malicious SQL commands.
Security Fix
@@ -3,7 +3,7 @@ Plugin Name: Amelia Plugin URI: https://wpamelia.com/ Description: Amelia is a simple yet powerful automated booking specialist, working 24/7 to make sure your customers can make appointments and events even while you sleep! -Version: 2.4.2 +Version: 2.4.3 Author: Melograno Ventures Author URI: https://melograno.io/ Text Domain: ameliabooking @@ -118,7 +118,7 @@ // Const for Amelia version if (!defined('AMELIA_VERSION')) { - define('AMELIA_VERSION', '2.4.2'); + define('AMELIA_VERSION', '2.4.3'); } // Const for site URL @@ -245,7 +245,7 @@ - **Plugin:** `tests/phpunit/Application/Commands/LoginNonceExemptionTest.php` locks the nonce exemption that lets the mobile app log in without a nonce/API key. Runs in CI via - the existing `phpunit` step in `bitbucket-pipelines.yml`. + the existing `PHPUnit` job in `.github/workflows/ci.yml`.
Exploit Outline
The exploit targets the plugin's custom API handler accessible via the WordPress AJAX endpoint. 1. **Endpoint Identification**: The attacker identifies an unauthenticated API endpoint used by the front-end booking interface, such as `/wp-admin/admin-ajax.php?action=wpamelia_api&call=/appointments` or `/events`. 2. **Parameter Manipulation**: User-supplied query parameters like `search`, `page`, or filter arrays (e.g., `services` or `categories`) are targeted. These parameters are historically processed in repository classes (like `AppointmentRepository`) where they might be concatenated directly into SQL strings without being passed through `$wpdb->prepare()`. 3. **Payload Construction**: An attacker crafts a payload using SQL syntax (e.g., `') UNION SELECT ... --`) to break out of the intended query logic and join data from the `wp_users` table or other database structures. 4. **Data Extraction**: Using either direct output (if the API returns the results of the modified query) or blind techniques (boolean-based or time-based), the attacker exfiltrates database contents such as administrator usernames, password hashes, or site configuration details. 5. **Authentication**: No authentication or specific user role is required to trigger the vulnerable code paths.
Check if your site is affected.
Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.