LetterPress-1.2.1-Open-Redirection-Via-Html-Injection-Vulnerability

Exploit Title: LetterPress <= 1.2.1 - Open Redirection Via Html Injection Vulnerability

Exploit Author: SANU P.L

CVE: NA

CVSS: NA

References: NIL

Description:

In LetterPress plugin <= 1.2.1 is vulnerable to Html Injection Vulnerability which can futher leads to Open Redirection Vulnerabilty.

Exploit:

1. In LetterPress plugin navigate to Add Campaign and insert the code "<a href=http://evil.com>CLICK THIS</a>" in HTML Campaign Message input field and click on Save Campaign.
2. View the campaign and click on "CLICK THIS" hyperlink it will redirect to the 3rdparty site. (Ex:evil.com)