WordPress Motopress Hotel Booking Lite 4.2.4 SQL Injection

WordPress Motopress Hotel Booking Lite plugin version 4.2.4 suffers from a remote SQL injection vulnerability.

MD5 | 293a1cf181729cd1f0a42687292b023c

Download

# Exploit Title: WordPress Plugin Motopress Hotel Booking Lite 4.2.4 - SQL Injection
# Date: 2022-04-11
# Exploit Author: Mohsen Dehghani (aka 0xProfessional)
# Vendor Homepage: https://motopress.com/
# Software Link: https://downloads.wordpress.org/plugin/motopress-hotel-booking-lite.4.2.4.zip
# Version: 4.2.4
# Tested on: Windows/XAMPP
###########################################################################
PoC:

Vulnerable File:sync-urls-repository.php

    public function insertUrls($roomId, $urls)
    {
        global $wpdb;

        if (empty($urls)) {
            return;
        }

        $urls = $this->prepareUrls($urls);
        $values = array();

        foreach ($urls as $syncId => $url) {
            $values[] = $wpdb->prepare("(%d, %s, %s)", $roomId, $syncId, $url);
        }

        $sql = "INSERT INTO {$this->tableName} (room_id, sync_id, calendar_url)"
            . " VALUES " . implode(', ', $values);

        $wpdb->query($sql);

Vulnerable Parameter:
room_id=SQL Injection
sync_id=SQL Injection

Source: packetstormsecurity.com