| Название | Stored XSS in flipbook |
|---|
| Описание | stored xss vulnerability in flipbook wordpress plugin with insert flipbook shortcut with javascript payload
1. install latest flipbook wordpress plugin
2. add new or edit exist posts
3. add flipbook shotcut like that [flipbook pdf= "sample.pdf"]
4. change pdf location to javascript payload like that [flipbook pdf= "javascript:alert(1)"]
POC:
https://drive.google.com/file/d/1gV1UL0P-La0Hx_4FtCpiBR-BKH8JGPPp/view?usp=sharing
https://drive.google.com/file/d/1nYGpfvr_7gGnoVnkSzmK8s99U9s_ndqC/view?usp=sharing
|
|---|
| Пользователь | rezaduty (UID 10530) |
|---|
| Представление | 01.11.2022 08:36 (4 лет назад) |
|---|
| Модерация | 01.11.2022 14:24 (6 hours later) |
|---|
| Статус | Дубликат |
|---|
| Запись VulDB | 212612 [Flipbook Plugin на WordPress Edit Post post.php Shortcode межсайтовый скриптинг] |
|---|
| Причина | not possible without admin permissions |
|---|
| Баллы | 0 |
|---|