WordPress Fitness Trainer - Training Membership plugin versions 1.0.8 and below suffer from a cross site scripting vulnerability.
a5296a2e992e7a24cea620dc13451720# Exploit Title: Wordpress Fitness Trainer - Training Membership Plugin <= v1.0.8 - Authenticated Stored/Reflected XSS
# Date: 2017-09-07
# Exploit Author: 8bitsec
# Vendor Homepage: https://codecanyon.net/item/fitness-trainer-training-membership-plugin/19901278
# Software Link: https://codecanyon.net/item/fitness-trainer-training-membership-plugin/19901278
# Version: 1.0.8
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: [email protected]
# Contact: https://twitter.com/_8bitsec
Release Date:
=============
2017-09-07
Product & Service Introduction:
===============================
Fitness Trainer - Training Membership Plugin
Technical Details & Description:
================================
Authenticated Stored XSS vulnerability found on Account Settings section.
Reflected XSS on profile parameter.
Proof of Concept (PoC):
=======================
Authenticated Stored XSS:
Logged as a low priv user.
Account Settings Section. Vulnerable Fields:
First Name
Last Name
Occupation
About
Website URL
Authenticated Reflected XSS on profile parameter:
https://localhost/fitnessp/my-account/?profile=<svg/onload=alert(document.domain)>
==================
8bitsec - [https://twitter.com/_8bitsec]