WordPress Plugin File Upload 4.3.2 – Stored Cross-Site Scripting

• Exploit Database
• 111 阅读

• 作者： ManhNho
  日期： 2018-04-10
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/44443/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34

  # Exploit Title: WordPress Plugin WordPress File Upload 4.3.2 - Stored XSS # Date: 31/03/2018 # Exploit Author: ManhNho # Vendor Homepage: https://www.iptanus.com/ # Software Link: https://downloads.wordpress.org/plugin/wp-file-upload.zip # Version: 4.3.2 # Tested on: CentOS 6.5 # CVE : CVE-2018-9172 # Category : Webapps   1. Description =========== WordPress File Upload is a WordPress plugin with more than 20.000 active installations. Version 4.3.2 (and possibly previous versions) are affected by a Stored XSS vulnerability in the admin panel ,related to the "Uploader Instances" functionality.   2. Proof of Concept ===========   1. Login to admin panel 2. Access to WordPress File Upload Control Panel. In Uploader Instances function, choose and edit created Instance 3. In Plugin ID field, inject XSS pattern such as: <script>alert(&apos;ManhNho&apos;)</script> and click Update button 4. Access to Pages/Posts contain upload option, we got alert ManhNho   3. References =========== <blockquote class="wp-embedded-content" data-secret="LfqOkBZ5Zk"><a href="https://www.iptanus.com/new-version-4-3-3-of-wordpress-file-upload-plugin/" target="_blank"rel="external nofollow" class="external" >New Version 4.3.3 of WordPress File Upload Plugin</a></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; visibility: hidden;" title="“New Version 4.3.3 of WordPress File Upload Plugin” — Iptanus" src="https://www.iptanus.com/new-version-4-3-3-of-wordpress-file-upload-plugin/embed/#?secret=Ss24VTmna4#?secret=LfqOkBZ5Zk" data-secret="LfqOkBZ5Zk" frameborder="0" marginmarginscrolling="no"></iframe> <blockquote class="wp-embedded-content" data-secret="lBJJW6rUp6"><a href="https://wordpress.org/plugins/wp-file-upload/" target="_blank"rel="external nofollow" class="external" >WordPress File Upload</a></blockquote><iframe class="wp-embedded-content" sandbox="allow-scripts" security="restricted" style="position: absolute; visibility: hidden;" title="“WordPress File Upload” — Plugin Directory" src="https://wordpress.org/plugins/wp-file-upload/embed/#?secret=ZJWfyW4L0z#?secret=lBJJW6rUp6" data-secret="lBJJW6rUp6" frameborder="0" marginmarginscrolling="no"></iframe> https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-9172