WordPress GetYourGuide Ticketing 1.0.6 Cross Site Scripting
2024-8-30 22:55:15 Author: packetstormsecurity.com(查看原文) 阅读量:0 收藏
WordPress GetYourGuide Ticketing 1.0.6 Cross Site Scripting
Posted Aug 30, 2024
Authored by indoushka

WordPress GetYourGuide Ticketing plugin version 1.0.6 suffers from a cross site scripting vulnerability.

tags | exploit, xss
SHA-256 | dcd22c45ffe7169dcb5e713498bc6fad3ab5097f2e800f6255a9b1b944a8c7ac
Download | Favorite | View
=============================================================================================================================================
| # Title     : WordPress GetYourGuide Ticketing plugin 1.0.6 XSS Vulnerability                                                             |
| # Author    : indoushka                                                                                                                   |
| # Tested on : windows 10 Fr(Pro) / browser : Mozilla firefox 128.0.3 (64 bits)                                                            |
| # Vendor    : https://downloads.wordpress.org/plugin/getyourguide-ticketing.1.0.6.zip                                                     |
=============================================================================================================================================
poc :
[+] Dorking İn Google Or Other Search Enggine.
[+] infected item : <input type="text" name="partner_hash" value="<?php echo $partner_hash?>"></input>
[+] Install the plugin ‘GetYourGuide Ticketing’ & activate it.
[+] Navigate toward the GYG-Ticketing.
[+] USe Payload : ` “><img src=x onerror=alert(1)>`
[+] Go to link builder to verify the XSS pop-up.
Greetings to :============================================================
jericho * Larry W. Cashdollar * LiquidWorm * Hussin-X * D4NB4R * CraCkEr |
==========================================================================

File Tags

Systems


文章来源: https://packetstormsecurity.com/files/180467/wpgygt106-xss.txt
如有侵权请联系:admin#unsafe.sh