CVE-2024-1207: WP Booking Calendar SQLi Vulnerability

CVE-2024-1207 Overview

The WP Booking Calendar plugin for WordPress contains a critical SQL Injection vulnerability in the calendar_request_params[dates_ddmmyy_csv] parameter affecting all versions up to and including 9.9. The vulnerability stems from insufficient escaping on user-supplied input and lack of proper preparation on existing SQL queries. This flaw allows unauthenticated attackers to inject malicious SQL queries that can extract sensitive information from the WordPress database, including user credentials, personal data, and other confidential information.

Critical Impact

Unauthenticated attackers can exploit this SQL Injection vulnerability to extract sensitive data from the database, potentially compromising the entire WordPress installation and all stored user information.

Affected Products

• WP Booking Calendar plugin for WordPress versions up to and including 9.9
• wpbookingcalendar booking_calendar (all vulnerable versions)
• WordPress sites using vulnerable WP Booking Calendar installations

Discovery Timeline

• 2024-02-08 - CVE-2024-1207 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-1207

Vulnerability Analysis

This SQL Injection vulnerability exists within the WP Booking Calendar plugin's date handling functionality. The vulnerable parameter calendar_request_params[dates_ddmmyy_csv] accepts user-controlled date values that are directly incorporated into SQL queries without adequate sanitization or parameterized query preparation. The lack of input validation allows attackers to break out of the intended query context and append arbitrary SQL commands.

The vulnerability is particularly dangerous because it requires no authentication to exploit. Any visitor to a WordPress site running a vulnerable version of WP Booking Calendar can potentially leverage this flaw to interact directly with the underlying database. Successful exploitation enables attackers to perform UNION-based, error-based, or blind SQL injection attacks to enumerate database contents, extract user tables, reveal administrator credentials, and potentially gain full control over the WordPress installation.

Root Cause

The root cause of CVE-2024-1207 is a classic CWE-89 (SQL Injection) vulnerability resulting from improper neutralization of special elements used in SQL commands. The plugin fails to implement proper input validation and escaping mechanisms for the dates_ddmmyy_csv parameter before incorporating it into database queries. WordPress provides prepared statement APIs through the $wpdb->prepare() method specifically designed to prevent SQL injection, but the vulnerable code paths do not utilize these security controls.

Attack Vector

The attack vector for this vulnerability is network-based, requiring no authentication, no user interaction, and minimal complexity to exploit. An attacker can craft malicious HTTP requests containing SQL injection payloads within the calendar_request_params[dates_ddmmyy_csv] parameter. These requests are processed by the vulnerable booking calendar functionality, where the injected SQL commands are executed against the WordPress database.

The exploitation flow typically involves:

1. Identifying a WordPress site running a vulnerable WP Booking Calendar version
2. Crafting HTTP requests with SQL injection payloads in the dates_ddmmyy_csv parameter
3. Extracting database schema information through error messages or blind injection techniques
4. Escalating the attack to dump sensitive tables including wp_users and wp_options
5. Using extracted credentials or session tokens to gain administrative access

Detection Methods for CVE-2024-1207

Indicators of Compromise

• Unusual HTTP requests containing SQL syntax characters (single quotes, UNION SELECT, OR 1=1) in the calendar_request_params[dates_ddmmyy_csv] parameter
• Database query errors in WordPress error logs indicating SQL syntax violations
• Unexpected database access patterns or queries against sensitive tables like wp_users
• Web server access logs showing repeated requests to booking calendar endpoints with encoded payloads

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect SQL injection patterns in booking calendar parameters
• Monitor WordPress database query logs for anomalous SELECT statements targeting user or options tables
• Deploy intrusion detection signatures for common SQL injection payloads in HTTP POST data
• Review access logs for suspicious request patterns targeting the WP Booking Calendar plugin endpoints

Monitoring Recommendations

• Enable detailed logging for all database queries executed by the WP Booking Calendar plugin
• Configure alerting for failed SQL queries that contain typical injection payload signatures
• Monitor for bulk data extraction patterns that may indicate successful exploitation
• Implement real-time log analysis for requests containing URL-encoded SQL special characters

How to Mitigate CVE-2024-1207

Immediate Actions Required

• Update WP Booking Calendar plugin to version 9.9.1 or later immediately
• If immediate patching is not possible, temporarily disable the WP Booking Calendar plugin
• Review WordPress database logs for evidence of prior exploitation attempts
• Reset all WordPress user passwords if compromise is suspected

Patch Information

The vulnerability has been addressed in the WP Booking Calendar plugin update. Users should apply the patch available through the WordPress Plugin Changeset. The fix implements proper input sanitization and utilizes WordPress's prepared statement functionality to prevent SQL injection. For detailed vulnerability information, refer to the Wordfence Vulnerability Report.

Workarounds

• Deploy a Web Application Firewall with SQL injection protection enabled to filter malicious requests
• Implement server-side input validation to reject requests containing SQL meta-characters in calendar parameters
• Restrict access to the booking calendar functionality using IP whitelisting if public access is not required
• Consider using a security plugin that provides virtual patching capabilities for known WordPress vulnerabilities

# Example WAF rule to block SQL injection attempts in booking calendar
# ModSecurity rule for Apache/Nginx
SecRule ARGS:calendar_request_params[dates_ddmmyy_csv] "@detectSQLi" \
    "id:100001,phase:2,deny,status:403,log,msg:'SQL Injection attempt blocked in WP Booking Calendar'"