CVE-2013-10029: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability classified as problematic was found in Exit Box Lite Plugin up to 1.06 on WordPress. Affected by this vulnerability is the function exitboxadmin of the file wordpress-exit-box-lite.php. The manipulation leads to cross-site request forgery. The attack can be launched remotely. Upgrading to version 1.10 is able to address this issue. The patch is named fad26701addb862c51baf85c6e3cc136aa79c309. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230671.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-06-05T21:15Z
Repository: https://github.com/wp-plugins/wordpress-exit-box-lite
Language: PHP
Files changed: wordpress-exit-box-lite.php
Commit date: 2013-05-28 17:47:25 +0000
Commit message: added security checks to avoid full path disclosure, XSS, unprivileged manipulation 

git-svn-id: https://plugins.svn.wordpress.org/wordpress-exit-box-lite/trunk@719474 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/wordpress-exit-box-lite.php b/wordpress-exit-box-lite.php
index 27219ac..a2557ff 100644
--- a/wordpress-exit-box-lite.php
+++ b/wordpress-exit-box-lite.php
@@ -1,22 +1,25 @@
 <?php
 
 /**
  * @package Wordpress Exit Box Lite
  * @author Bouzid Nazim Zitouni
- * @version 1.06
+ * @version 1.10
  */
 /*
 Plugin Name: Wordpress Exit Box Lite
 Plugin URI: http://angrybyte.com/wordpress-plugins/wordpress-exit-box-finally-released/
 Description: Wordpress exit box is used design and display your exit box, a ThickBox page that will be shown to your users when they click a external link.
 Author: Bouzid Nazim Zitouni
-Version: 1.06
+Version: 1.10
 Author URI: http://angrybyte.com
 */
 
-
+if(!function_exists('add_action')){
+    echo ""; // someone is trying to run the plugin directly, added to avoid full path disclosure.
+    die;
+}
 add_option("exitboxcontents",
     '<h2 style="text-align: center;">It was nice having you! We hope you enjoyed your stay.</h2>',
     'Contents of the Exit page', 'yes');
 add_option("exitboxdelay", '15', 'yes');
 add_option("boxautoredirect", '0', 'yes');
@@ -86,12 +89,11 @@ function exitboxadmin()
     add_options_page('Wordpress Exit Box Lite', 'Wordpress Exit Box Lite', 8,
         __file__, 'exit_box_admin');
 }
 function exit_box_admin()
 {
-
-    if ($_POST['xx'])
+     if (($_POST["xx"])&& (is_admin())&& check_admin_referer( 'exit_box_save', 'exit_box_nonce' ))
     {
 
         if (is_numeric($_POST['exitboxwidth']) || $_POST['exitboxwidth'] == "auto")
             update_option('exitboxwidth', $_POST['exitboxwidth']);
         if (is_numeric($_POST['exitboxheight']) || $_POST['exitboxheight'] == "auto")
@@ -127,11 +129,11 @@ EOFT;
 
     } else
     {
         echo "<textarea name='xx' cols='150' rows='20'>$oldtemp</textarea>";
     }
-
+    wp_nonce_field( 'exit_box_save','exit_box_nonce' ); 
     echo <<< EOFT
 
   <br/>
   <br/>
   <table><tbody>

Vulnerable code:  * @version 1.06
Version: 1.06


    if ($_POST['xx'])

Fixed code:  * @version 1.10
Version: 1.10
if(!function_exists('add_action')){
    echo ""; // someone is trying to run the plugin directly, added to avoid full path disclosure.
    die;
}
     if (($_POST["xx"])&& (is_admin())&& check_admin_referer( 'exit_box_save', 'exit_box_nonce' ))
    wp_nonce_field( 'exit_box_save','exit_box_nonce' );