CVE-2015-10109: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability was found in Video Playlist and Gallery Plugin up to 1.136 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality of the file wp-media-cincopa.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 1.137 is able to address this issue. The name of the patch is ee28e91f4d5404905204c43b7b84a8ffecad932e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230264.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-06-01T13:15Z
Repository: https://github.com/wp-plugins/video-playlist-and-gallery-plugin
Language: Other
Files changed: readme.txt, wp-media-cincopa.php
Commit date: 2015-08-31 11:22:50 +0000
Commit message: Security exploit fixed

git-svn-id: https://plugins.svn.wordpress.org/video-playlist-and-gallery-plugin/trunk@1234565 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/readme.txt b/readme.txt
index e895606..47fc019 100644
--- a/readme.txt
+++ b/readme.txt
@@ -1,8 +1,8 @@
 === Post video players, slideshow albums, photo galleries and music / podcast playlist ===
 Contributors: nicashmu
-Tags: cincopa, responsive, photos, html5, flash, flv, slideshow, images, amazon, gallery, media, cooliris, admin, post, WPtouch, photo-albums, pictures, plugin, widget, photo, picture, video hosting, s3, music, playlists, playlist, sidebar, ajax, video, vidavee, iphone, cms, ipod, smooth gallery, nextgen, javascript, embed, menus, analytics, media library, itunes, mu, podpress, lightbox, podpress, flowplayer, jw player, comments, twitter, page, google, links, image
+Tags: cincopa, responsive, photos, video, html5, slideshow, images, podcast, video portal, gallery, media, admin, post, WPtouch, photo-albums, pictures, widget, photo, picture, video hosting, s3, music, playlists, playlist, sidebar, ajax, video, vidavee, iphone, cms, ipod, smooth gallery, nextgen, javascript, embed, menus, analytics, media library, itunes, mu, podpress, lightbox, podpress, flowplayer, jw player, comments, twitter, page, google, links, image
 Requires at least: 2.0.2
 Tested up to: 4.2.2
 
 Post your videos, photo galleries/flash slideshows, music and playlists easily and in seconds.
 
diff --git a/wp-media-cincopa.php b/wp-media-cincopa.php
index 0676487..0b4afe4 100644
--- a/wp-media-cincopa.php
+++ b/wp-media-cincopa.php
@@ -2,36 +2,26 @@
 /*
 Plugin Name: Post video players, slideshow albums, photo galleries and music / podcast playlist
 Plugin URI: http://www.cincopa.com/media-platform/wordpress-plugin.aspx
 Description: Post rich videos and photos galleries from your cincopa account
 Author: Cincopa 
-Version: 1.136
+Version: 1.137
 */
 
 function _cpmp_plugin_ver()
 {
-	return 'wp1.136';
-}
-
-function _cpmp_afc()
-{
-	$cincopa_afc = get_site_option('CincopaAFC');
-	
-	if ($cincopa_afc == '')
-		return '';
-	
-	return '&afc='.$cincopa_afc;
+	return 'wp1.137';
 }
 
 function _cpmp_url()
 {
 	return '//www.cincopa.com';
 }
 
 if (strpos($_SERVER['REQUEST_URI'], 'media-upload.php') && strpos($_SERVER['REQUEST_URI'], '&type=cincopa') && !strpos($_SERVER['REQUEST_URI'], '&wrt='))
 {
-	header('Location: '._cpmp_url().'/media-platform/start.aspx?ver='._cpmp_plugin_ver()._cpmp_afc().'&rdt='.urlencode(_cpmp_selfURL()));
+	header('Location: '._cpmp_url().'/media-platform/start.aspx?ver='._cpmp_plugin_ver().'&rdt='.urlencode(_cpmp_selfURL()));
 	exit;
 }
 
 function _cpmp_selfURL()
 {
@@ -92,11 +82,11 @@ function media_cincopabox_process() {
         var_dump($_POST);
         
     }
     media_upload_header();
     ?>
-    <iframe src="<?php echo _cpmp_url().'/media-platform/start.aspx?ver='._cpmp_plugin_ver()._cpmp_afc().'&rdt='.urlencode(_cpmp_selfURL()."&")?>&" width="100%" height="98%"></iframe>
+    <iframe src="<?php echo _cpmp_url().'/media-platform/start.aspx?ver='._cpmp_plugin_ver().'&rdt='.urlencode(_cpmp_selfURL()."&")?>&" width="100%" height="98%"></iframe>
     <?php
 }
 function cincopabox_menu_handle() {
     
     return wp_iframe( 'media_cincopabox_process');
@@ -453,11 +443,11 @@ function _cpmp_dashboard()
 
 function _cpmp_dashboard_content()
 {
 
         
-	echo "<iframe src='//www.cincopa.com/media-platform/wordpress-dashboard-content.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='100%' height='370px' scrolling='no'></iframe>";
+	echo "<iframe src='//www.cincopa.com/media-platform/wordpress-dashboard-content.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='100%' height='370px' scrolling='no'></iframe>";
 
 }
 
 
 
@@ -473,32 +463,25 @@ function _cpmp_dashboard_content()
 add_action( 'admin_menu', 'changeUrl' );*/
 
 // action function for above hook
 function _cpmp_mt_add_pages()
 {
-
 	// Add a new submenu under Options:
 	
 	add_options_page('Cincopa Options', 'Cincopa Options', 'edit_pages', 'cincopaoptions', '_cpmp_mt_options_page');
 
-
 	if(function_exists('add_menu_page'))
 	{
 		// Add a new top-level menu (ill-advised):
 		add_menu_page('Cincopa', 'Cincopa', 'edit_pages', __FILE__, '_cpmp_mt_toplevel_page');
 
 		// kill the first menu item that is usually the the identical to the menu itself
 		add_submenu_page(__FILE__, '', '', 'edit_pages', __FILE__);
-
 		add_submenu_page(__FILE__, 'Manage Galleries', 'Manage Galleries', 'edit_pages', 'sub-page', '_cpmp_mt_sublevel_monitor');
-
 		add_submenu_page(__FILE__, 'Media Library', 'Media Library', 'edit_pages', 'sub-page1', '_cpmp_mt_sublevel_library');
-
 		add_submenu_page(__FILE__, 'Create Gallery', 'Create Gallery', 'edit_pages', 'sub-page2', '_cpmp_mt_sublevel_create');
-
 		add_submenu_page(__FILE__, 'My Account', 'My Account', 'edit_pages', 'sub-page3', '_cpmp_mt_sublevel_myaccount');
-
 		add_submenu_page(__FILE__, 'Support Forum', 'Support Forum', 'edit_pages', 'sub-page4', '_cpmp_mt_sublevel_forum');
 	}
 }
 
 function _cpmp_isAdmin()
@@ -514,12 +497,14 @@ function _cpmp_mt_options_page()
 	{
 		update_site_option('cincopa_welcome_notice', _cpmp_plugin_ver());
 		echo "<script type=\"text/javascript\">	document.location.href = '".$_SERVER['HTTP_REFERER']."'; </script>";
 		exit;
 	}
+	
+	if (empty($_COOKIE["csrfToken"]))
+		setcookie('csrfToken', md5(uniqid(rand(), true)));
 
-	$cincopa_afc = get_site_option('CincopaAFC');
 	$cincopa_excerpt = get_site_option('CincopaExcerpt');
 	$cincopa_async = get_site_option('CincopaAsync');
 	$cincopa_rss = get_site_option('CincopaRss');
 	$cincopa_opengraph = get_site_option('CincopaOpenGraph');
 	if ( $cincopa_opengraph === false ) {
@@ -528,17 +513,18 @@ function _cpmp_mt_options_page()
 		$cincopa_opengraph = 1;	
 	}
 	
 	if ( isset($_POST['submit']) )
 	{
+		if ($_POST['csrfToken'] != $_COOKIE['csrfToken'])
+		{
+			echo "nope";
+			exit();
+		}
+
 		if (_cpmp_isAdmin())
 		{
-			if (isset($_POST['cincopaafc']))
-			{
-				$cincopa_afc = $_POST['cincopaafc'];
-				update_site_option('CincopaAFC', $cincopa_afc);
-			}
 
 			if (isset($_POST['asyncRel']))
 			{
 				$cincopa_async = $_POST['asyncRel'];
 				update_site_option('CincopaAsync', $cincopa_async);			
@@ -589,10 +575,11 @@ function _cpmp_mt_options_page()
 		<h2>Cincopa Configuration</h2>
 		<div class="postbox-container">
 			<div class="metabox-holder">
 				<div class="meta-box-sortables">
 					<form action="" method="post" id="cincopa-conf">
+						<input type="hidden" name="csrfToken" value="<?php echo($_COOKIE["csrfToken"]) ?>" />
 						<div id="cincopa_settings" class="postbox">
 							<div class="handlediv" title="Click to toggle">
 								<br />
 							</div>
 							<h3 class="hndle">
@@ -601,11 +588,11 @@ function _cpmp_mt_options_page()
 							<div class="inside" style="width:600px;">
 								<table class="form-table">
 
 									<tr style="width:100%;">
 										<th valign="top" scrope="row">
-											<label for="cincopaafc">
+											<label>
 												Excerpt Handling (<a target="_blank" href="//help.cincopa.com/entries/448859-wordpress-plugin-settings-page#excerpt">what?</a>):
 											</label>
 										</th>
 										<td valign="top">
 
@@ -643,25 +630,10 @@ function _cpmp_mt_options_page()
 if (_cpmp_isAdmin())
 {
 ?>
 
 
-									<tr style="width:100%;">
-										<th valign="top" scrope="row">
-											<label for="cincopaafc">
-												Cincopa AFC (<a target="_blank" href="//help.cincopa.com/entries/448859-wordpress-plugin-settings-page#afc">what?</a>):
-											</label>
-										</th>
-										<td valign="top">
-											<input id="cincopaafc" name="cincopaafc" type="text" size="20" value="<?php echo $cincopa_afc; ?>"/>
-										</td>
-									</tr>
-
-
-
-
-
 									<tr style="width:100%;">
 										<th valign="top" scrope="row">
 											<label for="cincopaasync">
 												Async Engine (<a target="_blank" href="//help.cincopa.com/entries/448859-wordpress-plugin-settings-page#async">what?</a>):
 											</label>
@@ -738,28 +710,28 @@ function _cpmp_mt_manage_page() {
     echo "<h2>Test Manage</h2>";
 }
 */
 
 function _cpmp_mt_toplevel_page() {
-    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/start.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
+    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/start.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
 }
 
 function _cpmp_mt_sublevel_create() {
-    //echo "<iframe src='//www.cincopa.com/media-platform/wizard_name.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='98%' height='2000px'></iframe>";
-    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/start.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
+    //echo "<iframe src='//www.cincopa.com/media-platform/wizard_name.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='98%' height='2000px'></iframe>";
+    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/start.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
 }
 
 function _cpmp_mt_sublevel_monitor() {
-    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/wizard_edit15?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
+    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/wizard_edit15?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
 }
 
 function _cpmp_mt_sublevel_library() {
-    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/wizard2/library15?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
+    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/wizard2/library15?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
 }
 
 function _cpmp_mt_sublevel_myaccount() {
-    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/cincopaManager/manageaccount.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
+    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/cincopaManager/manageaccount.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
 }
 
 function _cpmp_mt_sublevel_forum() {
     //echo "<iframe src='//www.cincopa.com/redirect_to_help.aspx' width='98%' height='2000px'></iframe>";
     echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/learning-center' width='88%' height='100%'></iframe>";

Vulnerable code: Tags: cincopa, responsive, photos, html5, flash, flv, slideshow, images, amazon, gallery, media, cooliris, admin, post, WPtouch, photo-albums, pictures, plugin, widget, photo, picture, video hosting, s3, music, playlists, playlist, sidebar, ajax, video, vidavee, iphone, cms, ipod, smooth gallery, nextgen, javascript, embed, menus, analytics, media library, itunes, mu, podpress, lightbox, podpress, flowplayer, jw player, comments, twitter, page, google, links, image
Version: 1.136
	return 'wp1.136';
}

function _cpmp_afc()
{
	$cincopa_afc = get_site_option('CincopaAFC');
	
	if ($cincopa_afc == '')
		return '';
	
	return '&afc='.$cincopa_afc;
	header('Location: '._cpmp_url().'/media-platform/start.aspx?ver='._cpmp_plugin_ver()._cpmp_afc().'&rdt='.urlencode(_cpmp_selfURL()));
    <iframe src="<?php echo _cpmp_url().'/media-platform/start.aspx?ver='._cpmp_plugin_ver()._cpmp_afc().'&rdt='.urlencode(_cpmp_selfURL()."&")?>&" width="100%" height="98%"></iframe>
	echo "<iframe src='//www.cincopa.com/media-platform/wordpress-dashboard-content.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='100%' height='370px' scrolling='no'></iframe>";







	$cincopa_afc = get_site_option('CincopaAFC');
			if (isset($_POST['cincopaafc']))
			{
				$cincopa_afc = $_POST['cincopaafc'];
				update_site_option('CincopaAFC', $cincopa_afc);
			}
											<label for="cincopaafc">
									<tr style="width:100%;">
										<th valign="top" scrope="row">
											<label for="cincopaafc">
												Cincopa AFC (<a target="_blank" href="//help.cincopa.com/entries/448859-wordpress-plugin-settings-page#afc">what?</a>):
											</label>
										</th>
										<td valign="top">
											<input id="cincopaafc" name="cincopaafc" type="text" size="20" value="<?php echo $cincopa_afc; ?>"/>
										</td>
									</tr>





    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/start.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    //echo "<iframe src='//www.cincopa.com/media-platform/wizard_name.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='98%' height='2000px'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/start.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/wizard_edit15?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/wizard2/library15?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/cincopaManager/manageaccount.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
Fixed code: Tags: cincopa, responsive, photos, video, html5, slideshow, images, podcast, video portal, gallery, media, admin, post, WPtouch, photo-albums, pictures, widget, photo, picture, video hosting, s3, music, playlists, playlist, sidebar, ajax, video, vidavee, iphone, cms, ipod, smooth gallery, nextgen, javascript, embed, menus, analytics, media library, itunes, mu, podpress, lightbox, podpress, flowplayer, jw player, comments, twitter, page, google, links, image
Version: 1.137
	return 'wp1.137';
	header('Location: '._cpmp_url().'/media-platform/start.aspx?ver='._cpmp_plugin_ver().'&rdt='.urlencode(_cpmp_selfURL()));
    <iframe src="<?php echo _cpmp_url().'/media-platform/start.aspx?ver='._cpmp_plugin_ver().'&rdt='.urlencode(_cpmp_selfURL()."&")?>&" width="100%" height="98%"></iframe>
	echo "<iframe src='//www.cincopa.com/media-platform/wordpress-dashboard-content.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='100%' height='370px' scrolling='no'></iframe>";
	
	if (empty($_COOKIE["csrfToken"]))
		setcookie('csrfToken', md5(uniqid(rand(), true)));
		if ($_POST['csrfToken'] != $_COOKIE['csrfToken'])
		{
			echo "nope";
			exit();
		}

						<input type="hidden" name="csrfToken" value="<?php echo($_COOKIE["csrfToken"]) ?>" />
											<label>
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/start.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    //echo "<iframe src='//www.cincopa.com/media-platform/wizard_name.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='98%' height='2000px'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/start.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/wizard_edit15?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/wizard2/library15?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/cincopaManager/manageaccount.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";