WordPress Theme Enfold 4.8.3 – Reflected Cross-Site Scripting (XSS)

• Exploit Database
• 124 阅读

• 作者： David Álvarez Robles
  日期： 2021-10-19
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50427/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27

  # Exploit Title: WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting (XSS) # Google Dork: "inurl:avia-element-paging" # Date: 18/10/2021 # Exploit Author: Francisco Díaz-Pache Alonso, Sergio Corral Cristo and David Álvarez Robles # Vendor Homepage: https://kriesi.at/ # Version: Enfold < 4.8.4 (all versions) # Tested on: Ubuntu # CVE : CVE-2021-24719   # Full disclosure and PoC on: https://blog.asturhackers.es/cross-site-scripting-xss-reflejado-en-tema-enfold-4-8-4-para-wordpress   While navigating on WordPress sites with Enfold Theme previous than 4.8.4 version and Avia Page Builder, string “ProofOfConcept” can be reflected literallyon pagination numbers. Moreover, the parameter “avia-element-paging” appears and can be used for crafting Google Dork based searches.   https://[hostname]/[path]?ProofOfConcept --> This URL must include pages shown by Enfold theme   Changing the “ProofOfConcept” text with a Cross-Site-Scripting (XSS) payload, the page processes and executes it. This is a reflected Cross-Site-Scripting (XSS)vulnerability. Find the following URL that includes the malicious payload.   https://[hostname]/[path]/?%2527%253E%253Cscript%253Eeval%2528atob%2528%2522Y29uc29sZS5sb2coZG9j --> This URL must include pages shown by Enfold theme   Payload (double encoded): this payload is double encoded in the URL from: &apos;><script>eval(atob("Y29uc29sZS5sb2coZG9jdW1lbnQuY29va2llKQ=="))</script>   Payload (base64): the “atob” payload is Base64 encoded from: console.log(document.cookie)   Navigating to the crafted URL, the console log displays some cookies that are used by the affected site (i.e. cookies with no “HttpOnly” flag set). However, the payload can be easily configurable.