Exploit Collector
WordPress Metform Elementor Contact Form Builder 3.1.2 Cross Site Scripting

https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png WordPress Metform Elementor Contact Form Builder plugin versions 3.1.2 and below suffer from a persistent cross site scripting vulnerability.

SHA-256 | c049226eafcb4a203f2e5559ba9fda2836f1add53fb4cdf6aad29f235f957132Download Affected Plugin: Metform Elementor Contact Form Builder

Plugin Slug: metform

Affected Versions: <=

CVE ID: CVE-2023-0084

CVSS Score: 7.2 (High)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Researcher/s: Mohammed El Amin, Chemouri

Fully Patched Version: 3.2.0

The Metform Elementor Contact Form Builder plugin allows site builders to create highly functional contact forms. Unfortunately, vulnerable versions of the Metform plugin fail to escape submitted form entries when displaying them in the admin panel.

This meant that any site visitor could fill out a contact form with malicious JavaScript, and that the script would execute in the browser of any administrator viewing that form entry.

While sanitizing input may also have helped, escaping output is much more important for preventing Cross-Site Scripting as bypasses are far less common.

The patched version updated the format_form_data function to escape the output form data in order to address this issue.

An attacker able to execute JavaScript in the browser of an administrator can use it to take over a website via several methods, including by adding a new malicious administrator or injecting a backdoor into a plugin or theme on the site.

Unauthenticated Stored Cross-Site Scripting vulnerabilities are the most dangerous variant of Cross-Site Scripting for WordPress sites as they are much easier for attackers to automatically exploit en masse without needing an existing user account.

Timeline

January 4, 2023 - Mohammed Chemouri responsibly discloses the vulnerability to the plugin vendor and our Vulnerability Disclosure program.

January 8, 2023 - A patched version of the Metform plugin, 3.2.0, is made available.

February 3, 2023 - The Wordfence Threat Intelligence team discovers a potential bypass of the existing Cross-Site Scripting rule and releases an additional firewall rule to Wordfence Premium, Care, and Response sites.

March 5, 2023 - The firewall rule becomes available to Wordfence free users.

Conclusion

In today’s post we detailed an unauthenticated stored Cross-Site Scripting vulnerability in the Metform plugin discovered and responsibly disclosed by independent security researcher Mohammed Chemouri. The Wordfence firewall’s built-in Cross-Site Scripting protection should provide coverage for all Wordfence users including those using Wordfence free.

While we did find a potential bypass and deploy an additional rule to coverit, we have not seen this vulnerability exploited at a large scale in the wild, and have not seen any instances of the bypass being exploited. Nonetheless, we strongly recommend updating to the latest version of the Metform Elementor Contact Form Builder plugin, which is 3.2.1 at the time of this writing.

If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both of these products include hands-on support in case you need further assistance.

If you have any friends or colleagues who are using this plugin, please share this announcement with them and encourage them to update to the latest patched version of Metform Elementor Contact Form Builder as soon as possible.

If you are a security researcher, you can responsibly disclose your finds to us and obtain a CVE ID and get your name on the Wordfence Intelligence Community Edition leaderboard. Source:packetstormsecurity.com

Familiat Recon Tools for Pentesting and Bug Bounty
https://cyberw1ng.medium.com/familiat-recon-tools-for-pentesting-and-bug-bounty-b13dff19b2fa?source=rss------bug_bounty-5

10 Essential Tools used for Reconnaissance | Karthikeyan NagarajContinue reading on Medium » (https://cyberw1ng.medium.com/familiat-recon-tools-for-pentesting-and-bug-bounty-b13dff19b2fa?source=rss------bug_bounty-5)

Your own VPN with WireGuard (Raspberry Pi)

This guide will walk you through the process of setting up a VPN with WireGuard. WireGuard is a modern and secure VPN that is very easy to…Continue reading on InfoSec Write-ups »
Read more...

Burp Suite Android Emulator

Guide to setup Burp Suite on your Android EmulatorContinue reading on InfoSec Write-ups »
Read more...

hacking: security in practice
A Detailed Analysis of a New Stealer called Stealerium

https://external-preview.redd.it/v9QRvCCkJqd_cfmgx1LCBAZDFYYSn_1eyoDmX8_XmGA.jpg?width=320&crop=smart&auto=webp&s=5ac42db3ee2ae46ae8fcaf38f5311b09a9522367 submitted by /u/CyberMasterV
[link] [comments]

hacking: security in practice
Get same IP address for Metasploit payload to connect on...

Topic - Metasploit Payload not able to connect back to me cause of changed IP address.....

I don't know if this is possible or not and if I am making sense or not, but is there any way to get the same IP address every time for a payload to connect on.

I installed Metasploit on Google Cloud Console. We all know how we can use a Payload over WAN, and I did the same I used ngrok to make my Payload connect back to me over WAN(wide area network) but there is one problem, it is that everytime I launch Google cloud console it has a different IP address and that's why my payload is not able to connect back to me.

In order to make my Payload connect back to me I have to keep my Google Cloud Console machine online or open for the whole time and once I close it or restart it the IP changes and I don't get the connection back, Is there any solution to this problem.

I also don't get the same IP on ngrok too.

I guarantee that I don't want to use any of this information for any bad purposes, these are only for my Presentation at my college (to impress someone)...

submitted by /u/Disastrous-Let-9548
[link] [comments]

Hacking on Medium
AntiSec — Ethernaut Token

https://cdn-images-1.medium.com/max/1596/1*GiyTpyqASzGwIdR0LPXPaw.png
Performing Overflows on the Solidity Unsigned Integers

Continue reading on Medium »

Hacking on Medium
How AI and Blockchain are Reshaping the Landscape of Hacking and Cybersecurity

https://cdn-images-1.medium.com/max/1920/1*xegd9XiC0TVwGuC1btchEw.jpeg
Blockchain and AI are leaving their imprint on the IT sector, and it is clear that they have an influence on cybersecurity and hacking.
In…

Continue reading on Medium »

Hacking on Medium
CISSP Exam Prep: Why Training with Practice Questions is the Best Approach

https://cdn-images-1.medium.com/max/2600/1*Gt1BQvURX6Sx5-lhO7kUFA.jpeg
Maximizing your study efforts and acing the exam: An in-depth look at the benefits of training with practice questions

Continue reading on InfoSec Write-ups »

Hacking on Medium
OpenSSH lanza un parche para la nueva vulnerabilidad de autenticación doble gratuita

https://cdn-images-1.medium.com/max/1091/0*8gx0KFMuH9MPA8dR
Los mantenedores de OpenSSH han lanzado OpenSSH 9.2 para abordar una serie de errores de seguridad, incluida una vulnerabilidad de…

Continue reading on Medium »