CVE-2015-10109 (Other, published 2023-06-01T13:15Z)
Description: value: A vulnerability was found in Video Playlist and Gallery Plugin up to 1.136 on WordPress. It has been rated as problematic. Affected by this issue is some unknown functionality of the file wp-media-cincopa.php. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 1.137 is able to address this issue. The name of the patch is ee28e91f4d5404905204c43b7b84a8ffecad932e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230264.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/wp-plugins/video-playlist-and-gallery-plugin
Files changed:
readme.txt
wp-media-cincopa.php
Commit message: Security exploit fixed

git-svn-id: https://plugins.svn.wordpress.org/video-playlist-and-gallery-plugin/trunk@1234565 b8457f37-d9ea-0310-8a92-e5e31aec5664


Vulnerable code:
Tags: cincopa, responsive, photos, html5, flash, flv, slideshow, images, amazon, gallery, media, cooliris, admin, post, WPtouch, photo-albums, pictures, plugin, widget, photo, picture, video hosting, s3, music, playlists, playlist, sidebar, ajax, video, vidavee, iphone, cms, ipod, smooth gallery, nextgen, javascript, embed, menus, analytics, media library, itunes, mu, podpress, lightbox, podpress, flowplayer, jw player, comments, twitter, page, google, links, image
Version: 1.136
	return 'wp1.136';
}

function _cpmp_afc()
{
	$cincopa_afc = get_site_option('CincopaAFC');
	
	if ($cincopa_afc == '')
		return '';
	
	return '&afc='.$cincopa_afc;
	header('Location: '._cpmp_url().'/media-platform/start.aspx?ver='._cpmp_plugin_ver()._cpmp_afc().'&rdt='.urlencode(_cpmp_selfURL()));
    <iframe src="<?php echo _cpmp_url().'/media-platform/start.aspx?ver='._cpmp_plugin_ver()._cpmp_afc().'&rdt='.urlencode(_cpmp_selfURL()."&")?>&" width="100%" height="98%"></iframe>
	echo "<iframe src='//www.cincopa.com/media-platform/wordpress-dashboard-content.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='100%' height='370px' scrolling='no'></iframe>";







	$cincopa_afc = get_site_option('CincopaAFC');
			if (isset($_POST['cincopaafc']))
			{
				$cincopa_afc = $_POST['cincopaafc'];
				update_site_option('CincopaAFC', $cincopa_afc);
			}
											<label for="cincopaafc">
									<tr style="width:100%;">
										<th valign="top" scrope="row">
											<label for="cincopaafc">
												Cincopa AFC (<a target="_blank" href="//help.cincopa.com/entries/448859-wordpress-plugin-settings-page#afc">what?</a>):
											</label>
										</th>
										<td valign="top">
											<input id="cincopaafc" name="cincopaafc" type="text" size="20" value="<?php echo $cincopa_afc; ?>"/>
										</td>
									</tr>





    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/start.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    //echo "<iframe src='//www.cincopa.com/media-platform/wizard_name.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='98%' height='2000px'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/start.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/wizard_edit15?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/wizard2/library15?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/cincopaManager/manageaccount.aspx?ver="._cpmp_plugin_ver()._cpmp_afc()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";

Fixed code:
Tags: cincopa, responsive, photos, video, html5, slideshow, images, podcast, video portal, gallery, media, admin, post, WPtouch, photo-albums, pictures, widget, photo, picture, video hosting, s3, music, playlists, playlist, sidebar, ajax, video, vidavee, iphone, cms, ipod, smooth gallery, nextgen, javascript, embed, menus, analytics, media library, itunes, mu, podpress, lightbox, podpress, flowplayer, jw player, comments, twitter, page, google, links, image
Version: 1.137
	return 'wp1.137';
	header('Location: '._cpmp_url().'/media-platform/start.aspx?ver='._cpmp_plugin_ver().'&rdt='.urlencode(_cpmp_selfURL()));
    <iframe src="<?php echo _cpmp_url().'/media-platform/start.aspx?ver='._cpmp_plugin_ver().'&rdt='.urlencode(_cpmp_selfURL()."&")?>&" width="100%" height="98%"></iframe>
	echo "<iframe src='//www.cincopa.com/media-platform/wordpress-dashboard-content.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='100%' height='370px' scrolling='no'></iframe>";
	
	if (empty($_COOKIE["csrfToken"]))
		setcookie('csrfToken', md5(uniqid(rand(), true)));
		if ($_POST['csrfToken'] != $_COOKIE['csrfToken'])
		{
			echo "nope";
			exit();
		}

						<input type="hidden" name="csrfToken" value="<?php echo($_COOKIE["csrfToken"]) ?>" />
											<label>
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/start.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    //echo "<iframe src='//www.cincopa.com/media-platform/wizard_name.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='98%' height='2000px'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/start.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/wizard_edit15?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/media-platform/wizard2/library15?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";
    echo "<div style='clear: both;'></div><iframe style='position: fixed; left: 165px;' src='//www.cincopa.com/cincopaManager/manageaccount.aspx?ver="._cpmp_plugin_ver()."&src=".urlencode(_cpmp_selfURL())."' width='88%' height='100%'></iframe>";