# Exploit Title: Wordpress GigPress XSS # Date: 2015-09-15 # Exploit Author: Amir.ght # Vendor Homepage: https://wordpress.org/plugins/gigpress/ # Software Link: https://downloads.wordpress.org/plugin/gigpress.zip # Version: 2.3.12 # Tested on: windows 7 / FireFox #################################################### # Exploit : For Exploiting This Vulnerability You Should Install GigPress Plugin Goto Settings Of GigPress ,Now You Can Input Your JavaScript Code In Every input For Execution Codes click on "Save Changes" button #################################################################### # Vulnerable File : /wp-content/plugins/gigpress/admin/settings.php # Vulnerable codes: Lines : 24,29,35,54,61,68,77,83,89,95,101,116,148,168,174 [24] : <input type="text" size="48" name="gigpress_settings[shows_page]" value="<?php echo $gpo['shows_page']; ?>" /> [29] : <input type="text" name="gigpress_settings[noupcoming]" size="48" value="<?php echo $gpo['noupcoming']; ?>" /> [35] : <input type="text" name="gigpress_settings[nopast]" size="48" value="<?php echo $gpo['nopast']; ?>" /> [54] : <input type="text" name="gigpress_settings[date_format]" value="<?php echo $gpo['date_format']; ?>" /> [61] : <input type="text" name="gigpress_settings[date_format_long]" value="<?php echo $gpo['date_format_long']; ?>" /> [68] : <input type="text" name="gigpress_settings[time_format]" value="<?php echo $gpo['time_format']; ?>" /> [77] : <input type="text" name="gigpress_settings[artist_label]" size="48" value="<?php echo $gpo['artist_label']; ?>" /> [83] : <input type="text" name="gigpress_settings[tour_label]" size="48" value="<?php echo $gpo['tour_label']; ?>" /> [89] : <input type="text" name="gigpress_settings[external_link_label]" size="48" value="<?php echo $gpo['external_link_label']; ?>" /> [95] : <input type="text" name="gigpress_settings[buy_tickets_label]" size="48" value="<?php echo $gpo['buy_tickets_label']; ?>" /> [101] : <input type="text" name="gigpress_settings[age_restrictions]" size="48" value="<?php echo $gpo['age_restrictions']; ?>" /> [116] : <input type="text" name="gigpress_settings[related_heading]" size="48" value="<?php echo $gpo['related_heading']; ?>" /> [148] : <input type="text" name="gigpress_settings[related]" size="48" value="<?php echo $gpo['related']; ?>" /> [168] : <input type="text" name="gigpress_settings[rss_title]" size="48" value="<?php echo $gpo['rss_title']; ?>" /> [174] : <input type="text" name="gigpress_settings[rss_limit]" size="48" value="<?php echo $gpo['rss_limit']; ?>" /> ########################################################## # For Patch : Should Use htmlspecialchars() For Example Replace Line 24 With : <input type="text" size="48" name="gigpress_settings[shows_page]" value="<?php echo htmlspecialchars($gpo['shows_page']); ?>" />