CVE-2022-29450 (PHP, published 2022-06-15T19:15Z)
Description: value: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Admin Management Xtended plugin <= 2.4.4 at WordPress.


Severity: MEDIUM (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/oliverschloebe/admin-management-xtended
Files changed:
admin-management-xtended.php
css/styles.css
general-functions.php
js/functions.js
link-functions.php
media-functions.php
page-functions.php
post-functions.php
readme.txt
Commit message: 2.4.5 Release

* FIXED: WordPress 6.0 compatibility
* FIXED: CSRF vulnerabilities fixed (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29450)


Vulnerable code:
Version: 2.4.4
Copyright 2008-2021 Oliver Schlöbe (email : scripts@schloebe.de)
define("AME_VERSION", "2.4.4");
.status-draft, .status-future, .cannotdrop {
	-moz-opacity: 0.4;
 * Copyright 2008-2020 Oliver Schlöbe (email : scripts@schloebe.de)
			wp_enqueue_script( 'ame_miscscripts', AME_PLUGINFULLURL . "js/functions.js", array(
				'sack' 
			), AME_VERSION );
			wp_enqueue_script( 'ame_miscscripts', AME_PLUGINFULLURL . "js/functions.js", array(
				'sack' 
			), AME_VERSION );
			wp_enqueue_script( 'ame_miscscripts', AME_PLUGINFULLURL . "js/functions.js", array(
				'sack' 
			), AME_VERSION );
	ame_setupSuggest( postid );
Copyright 2008-2015 Oliver Schlöbe (email : scripts@schloebe.de)
Copyright 2008-2015 Oliver Schlöbe (email : webmaster@schloebe.de)
Copyright 2008-2020 Oliver Schlöbe (email : scripts@schloebe.de)
Copyright 2008-2020 Oliver Schlöbe (email : scripts@schloebe.de)
Tested up to: 6.9.9999

Fixed code:
Version: 2.4.5
Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
define("AME_VERSION", "2.4.5");
.cannotdrop {
	opacity: 0.4;

#TB_ajaxContent {
	overflow: hidden;
}

 * Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
	check_ajax_referer( 'ame_ajax_validation', 'security' );

	check_ajax_referer( 'ame_ajax_validation', 'security' );

	check_ajax_referer( 'ame_ajax_validation', 'security' );
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
			wp_register_script( 
				'ame_miscscripts',
				AME_PLUGINFULLURL . "js/functions.js",
				array( 'jquery', 'sack' ),
				AME_VERSION
			);   
			wp_enqueue_script( 'ame_miscscripts' );    
			wp_localize_script( 
				'ame_miscscripts',
				'ameAjaxSec',
				array(
					'ajaxnonce'	=> wp_create_nonce( 'ame_ajax_validation' )
				) 
			);
			wp_register_script( 
				'ame_miscscripts',
				AME_PLUGINFULLURL . "js/functions.js",
				array( 'jquery', 'sack' ),
				AME_VERSION
			);   
			wp_enqueue_script( 'ame_miscscripts' );    
			wp_localize_script( 
				'ame_miscscripts',
				'ameAjaxSec',
				array(
					'ajaxnonce'	=> wp_create_nonce( 'ame_ajax_validation' )
				) 
			);
			wp_register_script( 
				'ame_miscscripts',
				AME_PLUGINFULLURL . "js/functions.js",
				array( 'jquery', 'sack' ),
				AME_VERSION
			);   
			wp_enqueue_script( 'ame_miscscripts' );    
			wp_localize_script( 
				'ame_miscscripts',
				'ameAjaxSec',
				array(
					'ajaxnonce'	=> wp_create_nonce( 'ame_ajax_validation' )
				) 
			);
			ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
			ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
			ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
			ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
	ame_sack.setVar( "security", ameAjaxSec.ajaxnonce );
Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
	check_ajax_referer( 'ame_ajax_validation', 'security' );
	
	check_ajax_referer( 'ame_ajax_save_linkcategories' );
	
Copyright 2008-2022 Oliver Schlöbe (email : webmaster@schloebe.de)
Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
Copyright 2008-2022 Oliver Schlöbe (email : scripts@schloebe.de)
Tested up to: 6.1
= 2.4.5 =
* FIXED: WordPress 6.0 compatibility
* FIXED: CSRF vulnerabilities fixed (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29450)