CVE-2012-6506

Zingiri Web Shop 2.4.0 - Cross-Site Scripting via Page or Notes Parameter

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2012-6506. PoCs published by Mehmet Ince.

AI-analyzed exploit summary The exploit details multiple XSS vulnerabilities in the Wordpress Zingiri Web Shop Plugin <= 2.4.0, including a basic XSS via the 'page' parameter and a stored XSS via the 'notes' POST variable. The writeup provides step-by-step instructions for exploitation but does not include executable code.

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Zingiri Web Shop plugin 2.4.0 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) page parameter in zing.inc.php or (2) notes parameter in fws/pages-front/onecheckout.php.

Exploits (1)

exploitdb WRITEUP VERIFIED

by Mehmet Ince · textwebappsphp

https://www.exploit-db.com/exploits/18787

View Code ZIP pw:eip

The exploit details multiple XSS vulnerabilities in the Wordpress Zingiri Web Shop Plugin <= 2.4.0, including a basic XSS via the 'page' parameter and a stored XSS via the 'notes' POST variable. The writeup provides step-by-step instructions for exploitation but does not include executable code.

Classification

Writeup 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: Wordpress Zingiri Web Shop Plugin <= 2.4.0

No auth needed

Prerequisites: Access to the target WordPress site · For stored XSS, attacker needs to be logged in

MITRE ATT&CK