cve-2023-4596 nonce

[scotch123]

Only get this error: [-] Could not extract forminator_nonce

What's wrong ? ..

[E1A]

Hi there!

This exploit only works when a link is provided of the exact page where the file upload is enabled with Forminator. When a link is provided with just the domain or a page that is not running a file upload on it, it spits out the error you received. This is because it exports the forminator_nonce from the provided URL and if this page is not running Forminator or the Forminator file upload, it can't find it and can't use it.
I'll change the script and readme to make it more clear.

If you did provide a valid URL, could you answer the following questions for me to determine if something is wrong with the script?

1. Did you put the exact link of the page with file upload enabled in the command? File upload must of course be provided by Forminator which you can check by finding the string "forminator-field-upload" or "forminator-field-post-image-postdata" in the source code of the site. A full link, for example, looks like this: http://127.0.0.1:8000/?p=7
2. Did you use -v to check if Forminator is vulnerable?

[E1A]

Ping

[E1A]

Close since no response was submitted in 2 weeks

[forme9]

hi, Have the above issues been resolved?
How to find the exact link to the page that supports file uploads in Forminator?