WordPress Plugin Sell Downloads 1.0.86 – Cross-Site Scripting

• Exploit Database
• 90 阅读

• 作者： Mr Winst0n
  日期： 2019-09-09
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/47369/

• # Exploit Title: WordPress Plugin Sell Downloads 1.0.86 - Cross Site Scripting
  # Exploit Author: Mr Winst0n
  # Author E-mail: manamtabeshekan@gmail.com
  # Discovery Date: September 09,2019
  # Vendor Homepage: https://wordpress.dwbooster.com/content-tools/sell-downloads
  # Software Link : https://wordpress.org/plugins/sell-downloads/
  # Tested Version: 1.0.86
  # Tested on: Parrot OS, WordPress 5.1.1
  
  
  # PoC:
  1- Go to "Products for Sale" section
  2- Click on "Add New"
  3- In opend window click on "Add Comment"
  4- Fill comment as "/><img src=x onerror="alert()"> or "/><input type="text" onclick="alert()">
  5- Click on "Publish" (or "Update" if you editing an existing product)
  6- You will see a pop-up (also if click on input), Also if you go to product link will see the pop-up.
  

  Python

  Copy