41553c4004
11 changes to exploits/shellcodes Wing FTP Server 4.3.8 - Remote Code Execution (RCE) (Authenticated) Hotel Reservation System 1.0 - SQLi (Unauthenticated) Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit) FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE) Hospital Management System 4.0 - 'multiple' SQL Injection WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting (XSS) Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS) WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS) Windows/x86 - Locate kernel32 base address / Stack Crack method NullFree Shellcode (171 bytes)
26 lines
No EOL
1,012 B
Text
26 lines
No EOL
1,012 B
Text
# Exploit Title: WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS)
|
|
# Date: 2022-01-26
|
|
# Exploit Author: Shweta Mahajan
|
|
# Vendor Homepage: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/
|
|
# Software Link: https://en-gb.wordpress.org/plugins/titan-labs-security-audit/
|
|
# Tested on Windows
|
|
# CVE: CVE-2021-24901
|
|
# Reference:
|
|
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-24901
|
|
https://wpscan.com/vulnerability/9c315404-b66a-448c-a3b7-367a37b53435
|
|
|
|
How to reproduce vulnerability:
|
|
|
|
1. Install Latest WordPress
|
|
|
|
2. Install and activate Titan-labs-security-audit Version 1.0.0
|
|
|
|
3. Navigate to Security Audit settings >> enter the payload into 'Data Id'.
|
|
|
|
4. Enter JavaScript payload which is mentioned below
|
|
"><img src=x onerror=confirm(1)>
|
|
|
|
5. You will observe that the payload successfully got stored into the
|
|
database and when you are triggering the same functionality at that
|
|
time JavaScript payload gets executed successfully and we'll get a
|
|
pop-up. |