From 8ceb48a8eedd54497d3943825cdeb45533265327 Mon Sep 17 00:00:00 2001 From: Offensive Security Date: Wed, 26 May 2021 05:01:53 +0000 Subject: [PATCH] DB: 2021-05-26 2 changes to exploits/shellcodes Gadget Works Online Ordering System 1.0 - 'Category' Persistent Cross-Site Scripting (XSS) WordPress Plugin Cookie Law Bar 1.2.1 - 'clb_bar_msg' Stored Cross-Site Scripting (XSS) --- exploits/php/webapps/49904.txt | 28 ++++++++++++++++++++++++++++ exploits/php/webapps/49905.txt | 19 +++++++++++++++++++ files_exploits.csv | 2 ++ 3 files changed, 49 insertions(+) create mode 100644 exploits/php/webapps/49904.txt create mode 100644 exploits/php/webapps/49905.txt diff --git a/exploits/php/webapps/49904.txt b/exploits/php/webapps/49904.txt new file mode 100644 index 000000000..9d44ea273 --- /dev/null +++ b/exploits/php/webapps/49904.txt @@ -0,0 +1,28 @@ +# Exploit Title: Gadget Works Online Ordering System 1.0 - 'Category' Persistent Cross-Site Scripting (XSS) +# Date: 24-05-2021 +# Exploit Author: Vinay H C +# Vendor Homepage: https://www.sourcecodester.com/ +# Software Link: https://www.sourcecodester.com/php/13093/gadget-works-online-ordering-system-phpmysqli.html +# Version: 1.0 +# Tested on: Windows 10/XAMPP + +Stored Cross-site scripting(XSS): +Stored XSS, also known as persistent XSS, is the more damaging of the two. It occurs when a malicious script is injected directly into a vulnerable web application. + +Attack Vector : + +This vulnerability can result in the attacker to inject the XSS payload in the add Category field of the page and each time any user will open the website, the XSS triggers and attacker can able to steal the cookie according to the crafted payload. + +Vulnerable Parameters: +New==>Category input field. + +Payload : + +Vulnerable URL : +http://localhost/philosophy/admin/category/index.php?view=add + +Steps To Reproduce : +1) Go to the admin Dashboard +2) Click on New and select Category.. +3) Put Payload into the 'Add Category' parameter. +4) Click on Save. +5) XSS payload will be triggered. \ No newline at end of file diff --git a/exploits/php/webapps/49905.txt b/exploits/php/webapps/49905.txt new file mode 100644 index 000000000..9d1779ca7 --- /dev/null +++ b/exploits/php/webapps/49905.txt @@ -0,0 +1,19 @@ +# Exploit Title: WordPress Plugin Cookie Law Bar 1.2.1 - 'clb_bar_msg' Stored Cross-Site Scripting (XSS) +# Date: 2021-05-24 +# Exploit Author: Mesut Cetin +# Vendor Homepage: https://www.cookielawinfo.com/wordpress-plugin/ +# Software Link: https://wordpress.org/plugins/cookie-law-bar/ +# Version: 1.2.1 +# Tested on: Ubuntu 16.04 LTS, Wordpress 5.7.2 + +# the "Bar Message" text field is vulnerable to stored XSS due to unsanitized user input +# an authenticated attacker can retrieve cookies / sensitive data of all Wordpress users + +# proof of concept +# navigate to the settings of the Cookie Law Bar under + +http://localhost/wp-admin/options-general.php?page=clb + +# inject the payload: into the "Bar Message field" and save it + +# browsing through the Wordpress pages shows the cookies \ No newline at end of file diff --git a/files_exploits.csv b/files_exploits.csv index ecc32fd15..56b9d2b7e 100644 --- a/files_exploits.csv +++ b/files_exploits.csv @@ -44067,3 +44067,5 @@ id,file,description,date,author,type,platform,port 49901,exploits/java/webapps/49901.txt,"Shopizer 2.16.0 - 'Multiple' Cross-Site Scripting (XSS)",2021-05-24,"Marek Toth",webapps,java, 49902,exploits/multiple/webapps/49902.py,"Codiad 2.8.4 - Remote Code Execution (Authenticated) (2)",2021-05-24,"Ron Jost",webapps,multiple, 49903,exploits/php/webapps/49903.txt,"WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS)",2021-05-24,"Bastijn Ouwendijk",webapps,php, +49904,exploits/php/webapps/49904.txt,"Gadget Works Online Ordering System 1.0 - 'Category' Persistent Cross-Site Scripting (XSS)",2021-05-25,"Vinay H C",webapps,php, +49905,exploits/php/webapps/49905.txt,"WordPress Plugin Cookie Law Bar 1.2.1 - 'clb_bar_msg' Stored Cross-Site Scripting (XSS)",2021-05-25,"Mesut Cetin",webapps,php,