0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Wordpress Quick Contact Form Plugin 6.0 - Persistent XSS
[TITLE ===== Quick Contact Form - Persistent Cross Site Scripting Vulnerability AUTHOR ====== Zy0d0x DATE ==== 10/06/2013 VENDOR ====== Quick Plugins - http://quick-plugins.com/ AFFECTED PRODUCT ================ Quick Contact Form Wordpress Plugin Version 6.0 possibly earlier VULNERABILITY CLASS =================== Cross-Site Scripting DESCRIPTION =========== Quick Contact Form suffers from a persistent Cross-Site Scripting vulnerability due to a lack of input validation and output sanitization of the qcfname4 paramater. Other input fields are also effective to reflective cross site scripting. PROOF OF CONCEPT ================ Enter the following into the field where Quick Contact Form requests a Message. --- SNIP --- "><script>alert(String.fromCharCode(90,121,48,100,48,120))</script>< --- SNIP --- If the message has been sent successfully a alert diolog will apear containing Zy0d0x when an user checks there message in the dashboard. IMPACT ====== An attacker could potentially hijack session authentication tokes of remote users and leverage the vulnerability to increase the attack vector to the underlying software and operating system of the victim. THREAT LEVEL ============ High STATUS ====== Fixed update to version 6.1 # 0day.today [2024-10-05] #