PT-2021-16285 · WordPress · Contact Form Advanced Database

Quentin Villain · Published 2021-12-13 · Updated 2022-10-24 · CVE-2021-24790

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Contact Form Advanced Database WordPress plugin versions 1.0.8 and earlier

Description: The issue concerns the lack of authorization and CSRF checks in the delete cf7 data and export cf7 data AJAX actions, which are accessible to any authenticated users. This could allow users with a role as low as subscriber to call these actions, potentially leading to arbitrary metadata deletion. Additionally, if a suitable gadget chain is present in another plugin, it could result in PHP Object Injection, as user data is passed to the maybe unserialize() function without validation.

Recommendations: For Contact Form Advanced Database WordPress plugin versions 1.0.8 and earlier, consider disabling the delete cf7 data and export cf7 data AJAX actions until a patch is available to add proper authorization and CSRF checks. Restrict access to these actions to minimize the risk of exploitation. Avoid using the maybe unserialize() function with unvalidated user data in the affected AJAX endpoints. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2021-24790

Affected Products

Contact Form Advanced Database

References · 4

• 🔥 https://wpscan.com/vulnerability/adc5dd9b-0781-4cea-8cc5-2c10ac35b968 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24790 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24790 · Security Note
• https://t.me/cibsecurity/33822 · Telegram Post