358c35770a
17 changes to exploits/shellcodes Netgear Genie 2.4.64 - Unquoted Service Path OpenClinic GA 5.194.18 - Local Privilege Escalation Gestionale Open 11.00.00 - Local Privilege Escalation Hikvision Web Server Build 210702 - Command Injection WordPress Plugin TaxoPress 3.0.7.1 - Stored Cross-Site Scripting (XSS) (Authenticated) Engineers Online Portal 1.0 - File Upload Remote Code Execution (RCE) Build Smart ERP 21.0817 - 'eidValue' SQL Injection (Unauthenticated) Apache HTTP Server 2.4.50 - Remote Code Execution (RCE) (2) Balbooa Joomla Forms Builder 2.0.6 - SQL Injection (Unauthenticated) Online Event Booking and Reservation System 1.0 - 'reason' Stored Cross-Site Scripting (XSS) Engineers Online Portal 1.0 - 'multiple' Stored Cross-Site Scripting (XSS) Engineers Online Portal 1.0 - 'multiple' Authentication Bypass Engineers Online Portal 1.0 - 'id' SQL Injection WordPress Plugin Media-Tags 3.2.0.2 - Stored Cross-Site Scripting (XSS) WordPress Plugin Ninja Tables 4.1.7 - Stored Cross-Site Scripting (XSS) Wordpress 4.9.6 - Arbitrary File Deletion (Authenticated) (2) phpMyAdmin 4.8.1 - Remote Code Execution (RCE)
26 lines
No EOL
984 B
Text
26 lines
No EOL
984 B
Text
# Exploit Title: WordPress Plugin TaxoPress 3.0.7.1 - Stored Cross-Site Scripting (XSS) (Authenticated)
|
|
# Date: 23-10-2021
|
|
# Exploit Author: Akash Rajendra Patil
|
|
# Vendor Homepage:
|
|
# Software Link: https://wordpress.org/plugins/simple-tags/
|
|
# Tested on Windows
|
|
# CVE: CVE-2021-24444
|
|
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24444
|
|
# Reference: https://wpscan.com/vulnerability/a31321fe-adc6-4480-a220-35aedca52b8b
|
|
|
|
|
|
How to reproduce vulnerability:
|
|
|
|
1. Install Latest WordPress
|
|
|
|
2. Install and activate TaxoPress Version 3.0.7.1
|
|
3. Navigate to Add Table >> add the payload into 'Table Name & Descriptions'
|
|
and enter the data into the user input field.
|
|
|
|
4. Enter JavaScript payload which is mentioned below
|
|
"><img src=x onerror=confirm(docment.domain)>
|
|
|
|
5. You will observe that the payload successfully got stored into the
|
|
database and when you are triggering the same functionality in that
|
|
time JavaScript payload is executing successfully and we are getting a
|
|
pop-up. |