673a45a464
13 changes to exploits/shellcodes libupnp 1.6.18 - Stack-based buffer overflow (DoS) SAP Lumira 1.31 - Stored Cross-Site Scripting Foxit Reader 9.0.1.1049 - Arbitrary Code Execution Wordpress Theme Wibar 1.1.8 - 'Brand Component' Stored Cross Site Scripting WonderCMS 3.1.3 - 'uploadFile' Stored Cross-Site Scripting Ruckus IoT Controller (Ruckus vRIoT) 1.5.1.0.21 - Remote Code Execution Laravel Administrator 4 - Unrestricted File Upload (Authenticated) Acronis Cyber Backup 12.5 Build 16341 - Unauthenticated SSRF Moodle 3.8 - Unrestricted File Upload Wordpress Theme Accesspress Social Icons 1.7.9 - SQL injection (Authenticated) House Rental 1.0 - 'keywords' SQL Injection ElkarBackup 1.3.3 - 'Policy[name]' and 'Policy[Description]' Stored Cross-site Scripting Best Support System 3.0.4 - 'ticket_body' Persistent XSS (Authenticated)
34 lines
No EOL
1.4 KiB
Text
34 lines
No EOL
1.4 KiB
Text
# Exploit Title: Wordpress Theme Wibar 1.1.8 - 'Brand Component' Stored Cross Site Scripting
|
|
# Date: 11/27/2020
|
|
# Exploit Author: Ilca Lucian Florin
|
|
# Vendor Homepage: http://demo.themeftc.com/wibar
|
|
# Software Link: https://themeforest.net/item/wibar-responsive-woocommerce-wordpress-theme/20994798
|
|
# Version: 1.1.8
|
|
# Tested on: Latest Version of Desktop Web Browsers: Chrome, Firefox, Microsoft Edge
|
|
|
|
The WordPress theme contains Brands feature which is vulnerable to stored
|
|
cross site scripting. The logo URL parameter is vulnerable to cross site
|
|
scripting. The following vector was used for testing XSS: "><script
|
|
src="data:;base64,YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=="></script>.
|
|
|
|
In order to reproduce the vulnerability, please follow the next steps:
|
|
|
|
1. Log in as editor/administrator/contributor/author:
|
|
https://website.com/wp-admin
|
|
2. Go to Brands section
|
|
3. Click add new brand and add a custom brand title
|
|
4. The vulnerable parameter is: Logo URL / <input type="text"
|
|
name="ftc_brand_url" id="ftc_brand_url" value="">
|
|
5. Add the following payload: "><script
|
|
src="data:;base64,YWxlcnQoZG9jdW1lbnQuZG9tYWluKQ=="></script> , where
|
|
base64 == alert(document.domain)
|
|
6. Publish
|
|
7. The alert will pop up when a user will visit the website on
|
|
https://website.com/brand/vulnerablebrand.
|
|
|
|
Evidence:
|
|
|
|
1. https://ibb.co/1fpYJWN
|
|
2. https://ibb.co/S7j5Sgd
|
|
|
|
C.V.S.S Score: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:L / 7.5 High |