CVE-2015-8350 PoC — WordPress Calls to Action插件跨站脚本漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-8350.yaml

Associated Vulnerability

Title:WordPress Calls to Action插件跨站脚本漏洞 (CVE-2015-8350)
Description:WordPress是WordPress软件基金会的一套使用PHP语言开发的博客平台，该平台支持在PHP和MySQL的服务器上架设个人博客网站。Calls to Action是其中的一个活动召集插件。 WordPress Calls to Action插件2.4.3及之前版本中存在跨站脚本漏洞，该漏洞源于程序没有充分过滤用户提交的输入。当用户浏览受影响的网站时，其浏览器将执行攻击者提供的任意脚本代码。这可能导致攻击者窃取基于cookie的身份验证并发起其它攻击。

Description

Calls to Action plugin before 2.5.1 for WordPress contains stored XSS caused by unsanitized input in open-tab parameter in wp-admin/edit.php and wp-cta-variation-id parameter in ab-testing-call-to-action-example/, letting remote attackers inject arbitrary web script or HTML, exploit requires sending crafted requests.

File Snapshot


 id: CVE-2015-8350

info:
  name: WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS
  a

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!