Exploit for CVE-2025-26529

# 🛡️ CVE-2025-26529 Exploitability PoC — UNISA Exclusive

This repository contains a comprehensive **Proof-of-Concept (PoC)** scanner and exploitation framework targeting **CVE-2025-26529**, a critical XSS vulnerability in vulnerable Moodle instances.
This tool is designed specifically for **UNISA’s Moodle portal** (`https://mymodules.dtls.unisa.ac.za`) and must **only** be used under proper authorization and compliance with legal and institutional guidelines.

—

## ⚠️ DISCLAIMER

> 🔵 **Authorized Use Only**
> This PoC is intended **exclusively for authorized UNISA cyber incident response and audit teams**.
> Misuse of this tool may lead to **criminal prosecution**.
> Developed by **ScaryByte**, in collaboration with UNISA teams.

—

## 🚨 CVE Details

* **CVE-ID:** CVE-2025-26529
* **Type:** Reflected and DOM-based Cross-Site Scripting (XSS)
* **Impact:** Credential theft, session hijack, clickjacking, remote JS injection
* **Affected Software:** Moodle-based e-learning systems (core and unpatched plugins)
* **Attack Vector:** User input passed unsanitized to HTML context on vulnerable query routes

—

## 🔧 Requirements

Ensure Python 3.10+ is installed. Use a **virtualenv** for best isolation.

“`bash
sudo apt update && sudo apt install -y python3-pip chromium-driver
python3 -m venv venv-xss
source venv-xss/bin/activate
pip install -r requirements.txt
“`

### `requirements.txt`

“`txt
requests
beautifulsoup4
selenium
“`

—

## 🔍 Features

* ✅ CVE-2025-26529 reflected XSS payload testing
* ✅ DOM-based XSS detection using `MutationObserver`
* ✅ Cookie extraction and session hijack simulation
* ✅ Clickjacking iframe PoC generation
* ✅ Admin panel exposure verification
* ✅ Selenium-based rendering of DOM-XSS payloads

—

## 📂 Files

| File | Description |
| ———————– | —————————————— |
| `xss_checker.py` | Main PoC script |
| `clickjack_poc.html` | Generated iframe-based clickjacking attack |
| `dom_xss_poc.html` | DOM XSS PoC with MutationObserver listener |
| `cve2025_full_scan.log` | Full exploit scan log |
| `requirements.txt` | Python dependencies |

—

## 🧲 Usage

Run the scanner from an authorized Kali Linux instance:

“`bash
python3 xss_checker.py
“`

Expected output:

* Status of publicly exposed files
* Payload reflection confirmation
* Cookies sniffed via `Set-Cookie` headers
* Admin panel accessibility
* DOM XSS PoC auto-loaded in headless browser

—

## 🧪 DOM XSS PoC Preview

“`html

“`

—

## 🧬 Next Steps

* ✅ Validate PoC against staging and production environments.
* ↺ Extend to perform **authenticated session simulation**.
* 🔐 Integrate with **BurpSuite proxy** for full visibility.

—

## 📛 Legal Notice

This tool is part of a **UNISA vulnerability verification mandate** for CVE-2025-26529.
You are **not authorized** to use this PoC on any domain **except `mymodules.dtls.unisa.ac.za`** unless explicitly permitted.

—

## 🤝 Credits

* 💀 Maintained by [ScaryByte](https://scarybyte.online)

—