Stored XSS Vulnerability in Bookme Control Panel 2.0-[CVE-2018-8737]

[+] Credits: Neeraj Kumar
[+] Email: neeraj.iiita2009@gmail.com

Vendor:
====================
https://bylancer.com

Product:
===================
Bookme Control Panel 2.0

Link to access the Product:
===================
https://bylancer.com/products/bookme-wp-booking-plugin/

Vulnerability Type:
==========================
Cross site scripting - Stored XSS

CVE Reference:
==============
CVE-2018-8737

Vulnerability Details:
======================

Bookme Control Panel 2.0 Application is vulnerable to stored XSS within the Customers "Book Me" function. Within the Name and Note (aka custName and custNote) sections of the Customers screen, the application does not sanitize user-supplied input and renders injected JavaScript code to the user's browser. Attackers use this vulnerability to inject malicious javascript code such as hijack user sessions, malicious redirect, deface web sites, insert hostile content, redirect users, hijack the user’s browser using malware, etc.

XSS Exploit code(s):
====================
<script>alert(document.cookie)</script>

Affected Component:
====================
Field Name: Name, Note
Parameters Name: custName, custNote

Proof-of-Concept:
====================
1. Login into the site.
2. Goto “Book Me - Customers" Section.
3. Put <script>alert("document.cookie")</script> in Category Name & Note field then save it.
4. Access this page: https://<url>/products/bookme-wp-booking-plugin/wp-admin/admin.php?page=bookme-customers.
5. You will get the "cookie value" pop up.

Figure: Stored XSS

Disclosure Timeline:
=====================
Mitre Notification: March 15, 2018
Public Disclosure: March 17, 2018

Attack Type:
=====================
Remote

Impact Code execution:
=====================
True

Impact Information Disclosure
=====================
True

Description:
=====================================================
Request Method(s): [+] Post
Vulnerable Product: [+] Bookme Control Panel 2.0
Vulnerable Parameter(s): [+] custName and custNote

[+] Disclaimer
=====================================================

The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. All content (c).