Salon Booking System WordPress Plugin Cross-Site Request Forgery Vulnerability Allowing Remote Code Execution

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the Salon Booking System – Free Version plugin for WordPress, affecting all versions through 10.30.32. The vulnerability arises from inadequate nonce validation in the 'setCustomText' function, allowing unauthenticated attackers to inject arbitrary PHP code into the publicly accessible 'translate-constants.php' file within the plugin directory. This exploitation could lead to remote code execution on the server, provided the attacker can deceive a site administrator into clicking a link or performing a similar action. While the 'value' parameter is sanitized, the applied function does not remove certain characters necessary for breaking out of the PHP string literal, enabling the injection of malicious code that could be executed on the server.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, leading to unauthorized actions being performed on behalf of a user, potentially including the injection of malicious code that could be executed on the server.

Reproduction

To reproduce this vulnerability, an attacker must send a forged request to the WordPress site that includes the 'value' parameter with crafted PHP code. This request should be designed to exploit the missing nonce validation in the 'setCustomText' function. Once the request is received, the injected code will be executed on the server, resulting in remote code execution.

Remediation

Users are advised to update the Salon Booking System WordPress plugin to version 10.30.33 or later.