358c35770a
17 changes to exploits/shellcodes Netgear Genie 2.4.64 - Unquoted Service Path OpenClinic GA 5.194.18 - Local Privilege Escalation Gestionale Open 11.00.00 - Local Privilege Escalation Hikvision Web Server Build 210702 - Command Injection WordPress Plugin TaxoPress 3.0.7.1 - Stored Cross-Site Scripting (XSS) (Authenticated) Engineers Online Portal 1.0 - File Upload Remote Code Execution (RCE) Build Smart ERP 21.0817 - 'eidValue' SQL Injection (Unauthenticated) Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (2) Balbooa Joomla Forms Builder 2.0.6 - SQL Injection (Unauthenticated) Online Event Booking and Reservation System 1.0 - 'reason' Stored Cross-Site Scripting (XSS) Engineers Online Portal 1.0 - 'multiple' Stored Cross-Site Scripting (XSS) Engineers Online Portal 1.0 - 'multiple' Authentication Bypass Engineers Online Portal 1.0 - 'id' SQL Injection WordPress Plugin Media-Tags 3.2.0.2 - Stored Cross-Site Scripting (XSS) WordPress Plugin Ninja Tables 4.1.7 - Stored Cross-Site Scripting (XSS) Wordpress 4.9.6 - Arbitrary File Deletion (Authenticated) (2) phpMyAdmin 4.8.1 - Remote Code Execution (RCE)
18 lines
No EOL
859 B
Text
18 lines
No EOL
859 B
Text
# Exploit Title: WordPress Plugin Ninja Tables 4.1.7 - Stored Cross-Site Scripting (XSS)
|
|
# Date: 25-10-2021
|
|
# Exploit Author: Akash Rajendra Patil
|
|
# Vendor Homepage: https://wordpress.org/plugins/ninja-tables/
|
|
# Software Link: https://wpmanageninja.com/downloads/ninja-tables-pro-add-on/
|
|
# Version: 4.1.7
|
|
# Tested on Windows
|
|
|
|
*How to reproduce vulnerability:*
|
|
|
|
1. Install Latest WordPress
|
|
|
|
2. Install and activate Ninja Tables <= 4.1.7
|
|
3. Enter JavaScript payload which is mentioned below
|
|
"><img src=x onerror=confirm(docment.domain)> in the 'Coulmn Name & Add Data'
|
|
and enter the data into the user input field.Then Navigate to Table Design
|
|
|
|
5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality in that time JavaScript payload is executing successfully and we are getting a pop-up. |