CVE-2022-0739: BookingPress WordPress Plugin SQLi Flaw

CVE-2022-0739 Overview

CVE-2022-0739 is a critical SQL Injection vulnerability affecting the BookingPress WordPress plugin. The vulnerability exists because the plugin fails to properly sanitize user-supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action. This AJAX endpoint is accessible to unauthenticated users, making this a severe security risk that allows remote attackers to execute arbitrary SQL commands against the WordPress database without requiring any authentication.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data from the WordPress database, including user credentials, personally identifiable information, and potentially gain full control of the affected WordPress installation.

Affected Products

• BookingPress WordPress Plugin versions before 1.0.11
• reputeinfosystems bookingpress

Discovery Timeline

• 2022-03-21 - CVE-2022-0739 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-0739

Vulnerability Analysis

This SQL Injection vulnerability stems from insufficient input validation in the BookingPress WordPress plugin. The vulnerable code path involves the bookingpress_front_get_category_services AJAX action, which processes user-supplied POST data without adequate sanitization. Because WordPress AJAX handlers can be registered to accept requests from unauthenticated users, this endpoint becomes a direct attack vector accessible from the public internet.

The vulnerability allows attackers to manipulate SQL queries executed by the plugin, potentially leading to unauthorized data extraction, data modification, or even database destruction. Given the network-accessible nature of WordPress sites and the lack of authentication requirements for exploitation, this represents a significant risk to affected installations.

Root Cause

The root cause of CVE-2022-0739 is improper input sanitization (CWE-89: SQL Injection). The BookingPress plugin directly incorporates user-controlled POST parameters into SQL queries without using prepared statements or adequate escaping mechanisms. This classic SQL Injection pattern allows attackers to break out of the intended query structure and inject malicious SQL commands.

Attack Vector

The attack vector is network-based and requires no authentication. An attacker can craft malicious HTTP POST requests to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) with the action parameter set to bookingpress_front_get_category_services. By including specially crafted payloads in the POST data, the attacker can manipulate the underlying SQL query to extract sensitive information from the database using techniques such as UNION-based injection, blind SQL injection, or time-based inference attacks.

The vulnerability is exploited by sending malicious POST requests to the WordPress AJAX handler. Attackers inject SQL payloads through unsanitized parameters that are directly concatenated into database queries. This allows extraction of sensitive data including user credentials and administrative information. For detailed technical analysis, refer to the WPScan Vulnerability Report.

Detection Methods for CVE-2022-0739

Indicators of Compromise

• Unusual or malformed HTTP POST requests to /wp-admin/admin-ajax.php with action bookingpress_front_get_category_services
• SQL syntax or keywords appearing in POST parameters (e.g., UNION, SELECT, OR 1=1, --, single quotes)
• Multiple rapid requests from the same IP address targeting the BookingPress AJAX endpoint
• Database query logs showing unexpected queries or error messages related to SQL syntax

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block SQL Injection patterns in requests to WordPress AJAX endpoints
• Monitor web server access logs for suspicious requests containing SQL keywords targeting admin-ajax.php
• Deploy intrusion detection systems (IDS) with signatures for common SQL Injection attack patterns
• Enable WordPress database query logging to identify anomalous or malicious queries

Monitoring Recommendations

• Configure real-time alerting for requests containing SQL Injection patterns targeting the BookingPress plugin
• Establish baseline traffic patterns and alert on unusual volumes of requests to AJAX endpoints
• Monitor database performance metrics for anomalies that may indicate exploitation attempts
• Review WordPress error logs for database-related errors that could indicate injection attempts

How to Mitigate CVE-2022-0739

Immediate Actions Required

• Update the BookingPress WordPress plugin to version 1.0.11 or later immediately
• Audit the WordPress database for signs of unauthorized access or data extraction
• Review and rotate all user credentials, especially administrator accounts
• Implement a Web Application Firewall to block SQL Injection attempts while patching

Patch Information

The vulnerability has been addressed in BookingPress version 1.0.11. The fix implements proper input sanitization and parameterized queries to prevent SQL Injection attacks. The patch details can be reviewed in the WordPress Plugin Change Log. Site administrators should update to the patched version immediately through the WordPress plugin update mechanism.

Workarounds

• Temporarily disable the BookingPress plugin until it can be updated to the patched version
• Implement WAF rules to filter and block requests containing SQL Injection patterns to the vulnerable AJAX endpoint
• Restrict access to /wp-admin/admin-ajax.php at the web server level if BookingPress functionality is not required
• Use a security plugin that provides SQL Injection protection for WordPress

# Configuration example - WAF rule to block SQL injection patterns
# Example for ModSecurity (add to .htaccess or server config)
SecRule ARGS:action "@streq bookingpress_front_get_category_services" \
    "id:100001,phase:2,deny,status:403,msg:'Blocking vulnerable BookingPress endpoint',\
    chain"
SecRule ARGS "@detectSQLi" "t:none,t:urlDecodeUni"