exploit the possibilities

WordPress Zoner Real Estate Theme 4.1.1 Cross Site Scripting

WordPress Zoner Real Estate Theme 4.1.1 Cross Site Scripting
Posted Sep 27, 2019
Authored by m0ze

WordPress Zoner Real Estate theme version 4.1.1 suffers from a persistent cross site scripting vulnerability.

tags | exploit, xss
MD5 | 9a64eb855de166672afb3ef9c673f8c6

WordPress Zoner Real Estate Theme 4.1.1 Cross Site Scripting

Change Mirror Download
# Exploit Title: WordPress Theme Zoner Real Estate - 4.1.1 Persistent Cross-Site Scripting
# Google Dork: inurl:/wp-content/themes/zoner/
# Date: 2019-09-24
# Exploit Author: m0ze
# Vendor Homepage: https://fruitfulcode.com/
# Software Link: https://themeforest.net/item/zoner-real-estate-wordpress-theme/9099226
# Version: 4.1.1
# Tested on: Parrot OS


----[]- Persistent XSS: -[]----
Create a new agent account, log in and press the blue «Plus» button under
the main menu («Add Your Property» text will pop-up on hover) - you will be
redirected to https://zoner.demo-website.com/?add-property=XXXX page. Use
your payload inside «Address» input field («Local information» block),
press on the «Create Property» button and check your payload on the
https://zoner.demo-website.com/author/agentm0ze/?profile-page=my_properties
page. Your new property must be approved by admin, so this is a good point
to steal some cookies :)

Payload Sample: "><img src=x onerror=alert('Greetings from m0ze')>

PoC: log in as agentm0ze:WhgZbOUH (login/password) and go to the
https://zoner.demo-website.com/author/agentm0ze/?profile-page=my_properties
page.


----[]- IDOR: -[]----
Create a new agent account, log in and create a new property. Then go to
the
https://zoner.fruitfulcode.com/author/aaaagent/?profile-page=my_properties
page and pay attention to the trash icon under your property info. Open the
developers console and check out this code: <a title="Delete Property"
href="#" data-toggle="modal" class="delete-property"
data-propertyid="XXX"><i class="delete fa fa-trash-o"></i></a>. Edit the
data-propertyid="XXX" attribute by typing instead of XXX desired post or
page ID which you want to delete (you can get post/page ID on the <body>
tag class -> postid-494, so attribute for post with ID 494 will be
data-propertyid="494"). After you edit the ID, click on the trash icon and
confirm deletion (POST
https://zoner.fruitfulcode.com/wp-admin/admin-ajax.php?action=delete_property_act&property_id=494&security=1304db23f0).
Funny fact that you can delete ANY post & page (!) you want, security key
is not unique for each requests so it's possible to erase all pages and
posts within a few minutes.
Login or Register to add favorites

File Archive:

August 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    3 Files
  • 2
    Aug 2nd
    2 Files
  • 3
    Aug 3rd
    32 Files
  • 4
    Aug 4th
    22 Files
  • 5
    Aug 5th
    15 Files
  • 6
    Aug 6th
    19 Files
  • 7
    Aug 7th
    6 Files
  • 8
    Aug 8th
    1 Files
  • 9
    Aug 9th
    2 Files
  • 10
    Aug 10th
    27 Files
  • 11
    Aug 11th
    11 Files
  • 12
    Aug 12th
    11 Files
  • 13
    Aug 13th
    17 Files
  • 14
    Aug 14th
    7 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close