Vulnerability identifier: #VU25805

Vulnerability risk: High

CVSSv3.1: 7 [CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-9457

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
RegistrationMagic – Custom Registration Forms and User Login
Web applications / Modules and components for CMS

Vendor: Registrationmagic

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to unprotected "upload_template()","import_form_first_ajax()","view()" and "set_default_form()" AJAX actions. A remote authenticated attacker can upload a customized "vulnerable" registration form, then use the data export vulnerability to grab the information they need to launch the next step: by using yet another unprotected AJAX action, they can set an existing form on the site to expire after 0 submissions and replace it with their newly uploaded form. Once the vulnerable form is active, the attacker can register as an administrator.

If no forms are published, but the plugin’s “Magic Button” functionality is enabled, an attacker can also use an unprotected AJAX action to set their uploaded form as the “Default” form, which can be submitted from anywhere on the site.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

RegistrationMagic – Custom Registration Forms and User Login: 2.5.3 - 4.6.0.3

---

External links
http://wpvulndb.com/vulnerabilities/10116/
http://www.wordfence.com/blog/2020/03/multiple-vulnerabilities-patched-in-registrationmagic-plugin/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.