code-projects Online Shop 1.0 reflected XSS in view.php

#!/usr/bin/env python3
# verify_cve_2025_0175.py
# Checks whether code-projects Online Shop view.php appears vulnerable to CVE-2025-0175.
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

import os
import re
import sys

VULN_PATTERNS = [
    re.compile(r"echo\s*\(?\s*\$_GET\s*\[\s*['\"]name['\"]\s*\]\s*\)?", re.I),
    re.compile(r"echo\s*\(?\s*\$_GET\s*\[\s*['\"]details['\"]\s*\]\s*\)?", re.I),
]
SAFE_HINTS = [
    re.compile(r"htmlspecialchars\s*\(", re.I),
    re.compile(r"htmlentities\s*\(", re.I),
    re.compile(r"strip_tags\s*\(", re.I),
]

def find_view_php(root):
    if os.path.isfile(root):
        return root if os.path.basename(root).lower() == 'view.php' else None
    for dirpath, _, filenames in os.walk(root):
        for f in filenames:
            if f.lower() == 'view.php':
                return os.path.join(dirpath, f)
    return None

def main():
    if len(sys.argv) != 2:
        print("UNKNOWN - usage: python3 verify_cve_2025_0175.py <app_root_or_view.php>")
        sys.exit(2)

    target = sys.argv[1]
    if not os.path.exists(target):
        print(f"UNKNOWN - path does not exist: {target}")
        sys.exit(2)

    view_php = find_view_php(target)
    if not view_php:
        print("UNKNOWN - view.php not found")
        sys.exit(2)

    try:
        with open(view_php, 'r', encoding='utf-8', errors='ignore') as fh:
            content = fh.read()
    except Exception as e:
        print(f"UNKNOWN - cannot read {view_php}: {e}")
        sys.exit(2)

    name_raw = bool(VULN_PATTERNS[0].search(content))
    details_raw = bool(VULN_PATTERNS[1].search(content))
    safe_present = any(p.search(content) for p in SAFE_HINTS)

    # Heuristic result logic:
    # - vulnerable if raw echo for either parameter appears and no obvious output encoding is present.
    # - patched if the file exists and the raw patterns are absent, or if safe encoding wrappers are present around output.
    if (name_raw or details_raw) and not safe_present:
        print(f"VULNERABLE - raw $_GET output found in {view_php}")
        sys.exit(0)
    elif safe_present or (not name_raw and not details_raw):
        print(f"PATCHED - no raw vulnerable sink detected in {view_php}")
        sys.exit(1)
    else:
        print(f"UNKNOWN - manual review required for {view_php}")
        sys.exit(2)

if __name__ == '__main__':
    main()