Community by PeepSo < 6.3.1.2 - User Post Creation via CSRF

2024-01-0900:00:00

Bikram Kharal

wpscan.com

peepso community

user post creation

csrf attack

vulnerability

web security

6.3 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Description The plugin does not have CSRF check when creating a user post (visible on their wall in their profile page), which could allow attackers to make logged in users perform such action via a CSRF attack

PoC

1. Log in as a normal user. 2. Save the content below as an HTML file. 3. Change the ID and UID value to your account ID. 4. Open the above HTML file and submit it. A new post will be created and can be seen in the profile page (default /profile/)