0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
WordPress Dosimple Theme 2.0 Cross Site Scripting Vulnerability
[Document Title: =============== Wordpress Theme Dosimple v2.0 - XSS Web Vulnerability Abstract Advisory Information: ============================== An independent vulnerability laboratory researcher discovered a cross site web vulnerability in the Wordpress Theme Dosimple v2.0 web-application. Technical Details & Description: ================================ A non-persistent cross site scripting vulnerability has been discovered in the official Wordpress Theme Dosimple v2.0 web-application. The vulnerability allows remote attackers to inject own malicious script codes with non-persistent attack vector to compromise browser to web-application requests from the client-side. The cross site scripting vulnerabilities are located in the `s` parameter. The request method to inject the malicious script code is GET and the attack vector of the vulnerability is non-persistent on client-side. Successful exploitation of the vulnerability results in session hijacking, non-persistent phishing attacks, non-persistent external redirects to malicious source and non-persistent manipulation of affected application modules. Request Method(s): [+] GET Vulnerable Parameter(s): [+] s Proof of Concept (PoC): ======================= The non-persistent web vulnerability can be exploited by remote attackers without user account with low user interaction. For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue. PoC: Example https://localhost:8080/?s=<[NON-PERSISTENT CROSS SITE SCRIPTING!]> PoC: Exploitation https://localhost:8080/?s='"><script>alert(document.cookie)<%2Fscript> Reference(s): http://gogoneXt.ye.vc/?s='"><script>alert(document.domain)<%2Fscript> http://www.ndaXnndung.club/?s='"><script>alert(document.domain)<%2Fscript> https://besthoXme-designideas.rhcloud.com/?s='"><script>alert(document.domain)<%2Fscript> http://madmXaxuryroad.tk/?s='"><script>alert(document.domain)<%2Fscript> # 0day.today [2024-12-25] #