Exploit Title: LetterPress <= 1.2.1 – Open Redirection Via Html Injection Vulnerability
Exploit Author: P.L.Sanu
CVE:
CVSS:
References: https://github.com/plsanu/LetterPress-1.2.1-Open-Redirection-Via-Html-Injection-Vulnerability
Description:
In LetterPress plugin <= 1.2.1 is vulnerable to Html Injection Vulnerability which can futher leads to Open Redirection Vulnerabilty.
Exploit:
1. In LetterPress plugin navigate to Add Campaign and insert the code “CLICK THIS” in HTML Campaign Message input field and click on Save Campaign.
2. View the campaign and click on “CLICK THIS” hyperlink it will redirect to the 3rdparty site. (Ex:evil.com)
