PT-2018-10716 · Multidots · Multidots Add Social Share Messenger Buttons Whatsapp/Viber

Publicado 2018-05-31 · Atualizado 2018-07-02 · CVE-2018-11632

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin version 1.0.8

Description An issue in the plugin allows an attacker to change its settings via a crafted URL, exploiting a CSRF vulnerability in the wp-admin/admin-post.php endpoint. This can be achieved by tricking an admin user into visiting the malicious URL, potentially through spear phishing or social engineering tactics. The whatsapp share setting add update() function lacks a nonce or capability check, making it vulnerable to such attacks.

Recommendations For MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin version 1.0.8, consider disabling the whatsapp share setting add update() function until a patch is available to prevent exploitation. Restrict access to the wp-admin/admin-post.php endpoint to minimize the risk of CSRF attacks.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2018-11632

Produtos afetados

Multidots Add Social Share Messenger Buttons Whatsapp/Viber

Referências · 4

• 🔥 http://labs.threatpress.com/cross-site-request-forgery-csrf-in-add-social-share-messenger-buttons-whatsapp-and-viber-plugin · Exploit
• https://wordpress.org/plugins/add-social-share-buttons/#developers · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-11632 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-11632 · Aviso do Fabricante