Wordpress plugin jibu pro 1.7 crosssite scripting Vulnerability / Exploit
/
/
/
Exploits / Vulnerability Discovered : 2018-08-30 |
Type : webapps |
Platform : php
This exploit / vulnerability Wordpress plugin jibu pro 1.7 crosssite scripting is for educational purposes only and if it is used you will do on your own risk!
[+] Code ...
# Exploit Title: WordPress Plugin Jibu Pro 1.7 - Cross-Site Scripting
# Google Dork: inurl:"/wp-content/plugins/jibu-pro"
# Date: 2018-08-29
# Exploit Author: Renos Nikolaou
# Software Link: https://downloads.wordpress.org/plugin/jibu-pro.1.7.zip
# Version: 1.7
# Tested on: Kali Linux
# CVE: N/A
# Description: Jinu Pro is prone to Stored Cross Site Scripting vulnerabilities
# because it fails to properly sanitize user-supplied input.
# PoC - Stored XSS - Parameter: name
# 1) Login as a user who have access to Jibu Pro plugin.
# 2) Jibu-Pro --> Create Quiz.
# 3) At the Quiz Name type: poc"><script>alert(1)</script> , then fill the remaining fields and click Save.
# (The first pop-up will appear. Also keep note of the shortcode, similar to: [Test Number])
# 4) Click Create New Questions, fill the fields and click Save.
# 5) Copy the Shortcode [Test Number] into any post or page and visit the it via browser.