WordPress Facebook Page Promoter Lightbox Cross Site Scripting

2011.12.31

Credit: H4ckCity Security Team

Risk: Low

Local: No

Remote: Yes

CVE: N/A

CWE: CWE-79

Dork: \"Powered by Wordpress\"

############################################################################
# Exploit Title: Wordpress facebook-page-promoter-lightbox plugin Cross-Site Scripting Vulnerability
# Google Dork: "Powered by Wordpress"
# Date: 25/12/2011
# Author: H4ckCity Security Team
# Discovered By: Am!r (IrIsT)
# Home: WwW.H4ckCity.Org
# Software Link: http://wordpress.org/extend/plugins/facebook-page-promoter-lightbox/
# Version: All Version
# Security Risk:: Low
# Tested on: GNU/Linux Ubuntu - Windows Server
############################################################################
# Exploit:
#
# http://www.target.com/[path]/wp-content/plugins/facebook-page-promoter-lightbox/arevico_options.php?settings-updated=[xss]
#
#
############################################################################
# Special Thanks : Mehdi.H4ckcity-2MzRp-Mikili-farbodmahini-M.Prince-Bl4ck.Viper
# -iC0d3R-nitrojen90-K0242-kingcope-Mr.M4st3r , ...
############################################################################
GreetZ : All H4ckCity Member -BHG Members
############################################################################

References:

http://wordpress.org/extend/plugins/facebook-page-promoter-lightbox/

See this note in RAW Version

Vote for this issue:

50%

Thanks for you vote!

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

Nick (*)

Email (*)

Video

Text (*)

(*) - required fields.

{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1

{{ x.comment }}

WordPress Facebook Page Promoter Lightbox Cross Site Scripting

Dork: \"Powered by Wordpress\"

References:

Thanks for you vote!

Thanks for you comment!Your message is in quarantine 48 hours.

Thanks for you comment!
Your message is in quarantine 48 hours.