WordPress Plugin Multi-Scheduler 1.0.0 – Cross-Site Request Forgery (Delete User) - 体验盒子

作者： UnD3sc0n0c1d0

日期： 2020-05-29

类别：

平台：

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

# Exploit Title: WordPress Plugin Multi-Scheduler 1.0.0 - Cross-Site Request Forgery (Delete User)

# Google Dork: N/A

# Date: 2020-05-21

# Exploit Author: UnD3sc0n0c1d0

# Vendor Homepage: https://www.bdtask.com/

# Software Link: https://downloads.wordpress.org/plugin/multi-scheduler.1.0.0.zip

# Category: Web Application

# Version: 1.0.0

# Tested on: CentOS 7 / WordPress 5.4.1

# CVE : N/A

# 1. Technical Description:

The Multi-Scheduler plugin 1.0.0 for WordPress has a Cross-Site Request Forgery (CSRF) vulnerability

in the forms it presents, allowing the possibility of deleting records (users) when an ID is known.

# 2. Proof of Concept (PoC):

<html>

</form>

</html>