Exploit WordPress Plugin Banners Lite - 'wpbanners_show.php' HTML Injection

[Exploiter]

EDB-ID

38410

Проверка EDB

1. Пройдено

Автор

FERNANDO A. LAGOS B

Тип уязвимости

WEBAPPS

Платформа

PHP

CVE

N/A

Дата публикации

2013-03-25

WordPress Plugin Banners Lite - 'wpbanners_show.php' HTML Injection

source: https://www.securityfocus.com/bid/58671/info

The Banners Lite plugin for WordPress is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 

http://www.example.com/wordpress/wp-content/plugins/wp-banners-lite/wpbanners_show.php?id=1&cid=a_<script>alert(/XSSProof-of-Concept/)</script>