| 제목 | Stored XSS in flipbook |
|---|
| 설명 | stored xss vulnerability in flipbook wordpress plugin with insert flipbook shortcut with javascript payload
1. install latest flipbook wordpress plugin
2. add new or edit exist posts
3. add flipbook shotcut like that [flipbook pdf= "sample.pdf"]
4. change pdf location to javascript payload like that [flipbook pdf= "javascript:alert(1)"]
POC:
https://drive.google.com/file/d/1gV1UL0P-La0Hx_4FtCpiBR-BKH8JGPPp/view?usp=sharing
https://drive.google.com/file/d/1nYGpfvr_7gGnoVnkSzmK8s99U9s_ndqC/view?usp=sharing
|
|---|
| 사용자 | rezaduty (UID 10530) |
|---|
| 제출 | 2022. 11. 01. AM 08:36 (4 연령 ago) |
|---|
| 모더레이션 | 2022. 11. 01. PM 02:24 (6 hours later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 212612 [Flipbook Plugin 켜짐 WordPress Edit Post post.php Shortcode 크로스 사이트 스크립팅] |
|---|
| 이유 | not possible without admin permissions |
|---|
| 포인트들 | 0 |
|---|