Lucene search
Vinay Varma MudunuriWPVDB-ID:8AE42EC0-7E3A-4EA5-8E76-0AAE7B92A8E9HistoryNov 03, 2022 - 12:00 a.m.
Find and Replace All <= 1.3 - Arbitrary Replacement via CSRF
2022-11-0300:00:00
Vinay Varma Mudunuri
wpscan.com
7
csrf
plugin
attack
database
tables
admin
security
logged-in
0.001 Low
EPSS
Percentile
33.3%
The plugin does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack
PoC
Make a logged in admin open a page with the below code
| CPE | Name | Operator | Version |
|---|---|---|---|
| find-and-replace-all | lt | 1.3 |
Related
cvelist
cvelist
CVE-2022-3850 Find and Replace All <= 1.3 - Arbitrary Replacement via CSRF
2022-11-28 13:47:12
wpexploit
wpexploit
Find and Replace All <= 1.3 - Arbitrary Replacement via CSRF
2022-11-03 00:00:00
prion
prion
Cross site request forgery (csrf)
2022-11-28 14:15:00
nvd
nvd
CVE-2022-3850
2022-11-28 14:15:18
patchstack
patchstack
cnvd
cnvd
cve
cve
CVE-2022-3850
2022-11-28 14:15:18