🍔 RestroPress – Online Food Ordering System 3.0.0 - 3.1.9.2

🛡️ CVE-2025-9209.py — Mass Automatic Exploit & Extraction Tool

---

⚠️ Vulnerability Overview

RestroPress – Online Food Ordering System versions 3.0.0 to 3.1.9.2 are affected by an Unauthenticated Information Exposure leading to Authentication Bypass via Forged JWT.

The plugin exposes user private tokens and API key data, allowing unauthenticated attackers to forge JWT tokens, gaining full access to other users—including administrators.

• CVE: CVE-2025-9209
• CVSS: 9.8 (Critical)
• Impact: Full account takeover possible without prior authentication.

---

---

🚀 Script Features

• Ultra-fast site scanning (multi-threaded execution for large lists)
• Auto-detects and extracts all available private/public keys, tokens, and authentication info for every accessible account.
• Mass exploitation — identifies multiple vulnerable accounts per site.
• Reliable credential extraction — validates credentials during exploitation.
• Output to four structured files:
  • exposures.txt — Found exposures and credentials.
  • tokens.txt — JWT tokens extracted.
  • exploited_sites.txt — Sites with multiple exposed accounts.
  • cookies.txt — Session cookies from successful exploitation.
• Requires no authentication or elevated privileges.
• Resilient to network failures and blockages; recovers and retries transparently.
• Thread-safe file writing for consistent results.

---

🛠️ Usage

1. Place a list of target WordPress sites in a text file (one URL per line):

   root@kitploit:~

   targets.txt
   

   Example:

   root@kitploit:~

   https://example.com
   https://victim01.com
   

2. Run the script:

   root@kitploit:~

   python3 CVE-2025-9209.py
   

3. Follow prompts for thread count, verification, curl fallback, and request delay.

4. Review outputs in the generated text files (exposures.txt, tokens.txt, exploited_sites.txt, and cookies.txt).

---

✨ Author

By: Nxploited ( Khaled Alenazi )

---

⚖️ Disclaimer

• This tool is provided for educational and authorized security testing only.
• Do not use against systems or data without explicit permission.
• The author assumes no responsibility for misuse or damage resulting from the use of this script.

---