41553c4004
11 changes to exploits/shellcodes Wing FTP Server 4.3.8 - Remote Code Execution (RCE) (Authenticated) Hotel Reservation System 1.0 - SQLi (Unauthenticated) Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit) FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE) Hospital Management System 4.0 - 'multiple' SQL Injection WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting (XSS) Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS) WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS) Windows/x86 - Locate kernel32 base address / Stack Crack method NullFree Shellcode (171 bytes)
26 lines
No EOL
940 B
Text
26 lines
No EOL
940 B
Text
# Exploit Title: WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS)
|
|
# Date: 2022-02-02
|
|
# Exploit Author: Shweta Mahajan
|
|
# Vendor Homepage: https://wordpress.org/plugins/cp-blocks/
|
|
# Software Link: https://wordpress.org/plugins/cp-blocks/
|
|
# Tested on Windows
|
|
# CVE: CVE-2022-0448
|
|
# Reference:
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0448
|
|
https://wpscan.com/vulnerability/d4ff63ee-28e6-486e-9aa7-c878b97f707c
|
|
|
|
How to reproduce vulnerability:
|
|
|
|
1. Install Latest WordPress
|
|
|
|
2. Install and activate CP Blocks Version 1.0.14
|
|
|
|
3. Navigate to CP Blocks - License >> enter the payload into 'License ID'.
|
|
|
|
4. Enter JavaScript payload which is mentioned below
|
|
"><script>alert(0)</script>
|
|
|
|
5. You will observe that the payload successfully got stored into the
|
|
database and when you are triggering the same functionality at that
|
|
time JavaScript payload gets executed successfully and we'll get a
|
|
pop-up. |