Lucene search
Daniel RufWPVDB-ID:4A36E876-7E3B-4A81-9F16-9FF5FBB20DD6HistoryJun 20, 2022 - 12:00 a.m.
Admin Management Xtended < 2.4.5 - Post Visibility/Date/Comment Status Update via CSRF
2022-06-2000:00:00
Daniel Ruf
wpscan.com
5
csrf prevention
post visibility
date update
comment status
ajax actions
security plugin
EPSS
0.001
Percentile
26.3%
The plugin does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more.
PoC
The following PoC codes are for post ID 1 (rndval is really just a random value):
Related
patchstack
patchstack
cnvd
cnvd
WordPress Admin Management Xtended pluginθ·¨η«θ―·ζ±δΌͺι ζΌζ΄
2022-07-13 00:00:00
osv
osv
CVE-2022-1599
2022-07-11 13:15:08
cve
cve
CVE-2022-1599
2022-07-11 13:15:08
nvd
nvd
CVE-2022-1599
2022-07-11 13:15:08
cvelist
cvelist
prion
prion
Cross site request forgery (csrf)
2022-07-11 13:15:00
wpexploit
wpexploit